Falhas do tipo CWE-434

3.244 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2015-10138CRITICALWork The Flow File Upload <= 2.5.2 - Arbitrary File UploadEPSS 4.2%CVE-2026-5718HIGHDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist BypassEPSS 4.2%CVE-2022-40797CRITICALRoxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .phEPSS 4.1%CVE-2023-52324HIGHAn unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected inEPSS 4.1%CVE-2023-48777CRITICALWordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerabilityEPSS 4.1%CVE-2026-15748CRITICALForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field ConfigurationEPSS 4.1%CVE-2024-8425CRITICALWooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File UploadEPSS 4.1%CVE-2019-3940—Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use thiEPSS 4.1%CVE-2021-39145HIGHXStream is vulnerable to an Arbitrary Code Execution attackEPSS 4.1%CVE-2021-22698—A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 aEPSS 4.0%CVE-2025-2749HIGHKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEEPSS 4.0%KEVCVE-2019-18288—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with valid authentiEPSS 4.0%CVE-2024-39717MEDIUMThe Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logEPSS 4.0%KEVCVE-2026-14483CRITICALRealtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' CommandEPSS 4.0%CVE-2022-20743MEDIUMCisco Firepower Management Center File Upload Security Bypass VulnerabilityEPSS 4.0%CVE-2021-24220—All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option DeletionEPSS 3.9%CVE-2026-84434CRITICALGravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload FieldEPSS 3.9%CVE-2023-3722HIGHAvaya Aura Device Services Remote Code ExecutionEPSS 3.9%CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.9%CVE-2020-6008—LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionEPSS 3.8%