Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-69828CRITICALFile Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitraryEPSS 0.6%CVE-2024-2636CRITICALMultiple vulnerabilities on Meta4 HR from CegidEPSS 0.6%CVE-2026-55778LOWParse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklistEPSS 0.6%CVE-2025-0346MEDIUMcode-projects Content Management System Publish News Page publishnews.php unrestricted uploadEPSS 0.6%CVE-2024-49658CRITICALWordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2025-1834MEDIUMzj1983 zz resolve unrestricted uploadEPSS 0.6%CVE-2025-13689HIGHDataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environmentEPSS 0.6%CVE-2026-1730HIGHOS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File UploadEPSS 0.6%CVE-2026-2666MEDIUMmingSoft MCMS Template Archive uploadTemplate.do unrestricted uploadEPSS 0.6%CVE-2025-23171HIGHThe Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly EPSS 0.6%CVE-2025-13066HIGHDemo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload BypassEPSS 0.6%CVE-2023-51806HIGHFile Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.EPSS 0.5%CVE-2024-8330HIGHGether Technology 6SHR System - Unrestricted File UploadEPSS 0.5%CVE-2025-67288CRITICALAn arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOEPSS 0.5%CVE-2025-37132HIGHAuthenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File WriteEPSS 0.5%CVE-2025-12153HIGHFeatured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle UploadEPSS 0.5%CVE-2026-33717HIGHAVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation AbortEPSS 0.5%CVE-2025-27082HIGHAuthenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File WriteEPSS 0.5%CVE-2023-40731MEDIUMA vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary filEPSS 0.5%CVE-2024-8164MEDIUMChengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted uploadEPSS 0.5%