Falhas do tipo CWE-434

3.081 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2026-58480CRITICALBlocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachmentsEPSS 3.6%CVE-2024-9290CRITICALSuper Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File UploadEPSS 3.5%CVE-2026-5524CRITICALDivi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' ParameterEPSS 3.5%CVE-2021-22697—A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 aEPSS 3.5%CVE-2019-1888HIGHCisco Unified Contact Center Express Privilege Escalation VulnerabilityEPSS 3.4%CVE-2021-44159CRITICAL4MOSAn GCB Doctor - Unrestricted Upload of FileEPSS 3.4%CVE-2024-48594HIGHFile Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload componentEPSS 3.4%CVE-2024-52302HIGHcommon-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)EPSS 3.4%CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.3%CVE-2016-9492—PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file typesEPSS 3.3%CVE-2026-22241HIGHOpen eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)EPSS 3.3%CVE-2012-10019CRITICALFront-end Editor < 2.3 - Arbitrary File UploadEPSS 3.3%CVE-2025-34086HIGHBolt CMS Authenticated Remote Code Execution via Profile Injection and File RenameEPSS 3.3%CVE-2022-2297MEDIUMSourceCodester Clinics Patient Management System unrestricted uploadEPSS 3.3%CVE-2025-54769HIGHKL-001-2025-016: Xorux LPAR2RRD File Upload Directory TraversalEPSS 3.2%CVE-2021-4462CRITICALEmployee Records System v1.0 Arbitrary File Upload RCEEPSS 3.2%CVE-2026-1405CRITICALSlider Future <= 1.0.5 - Unauthenticated Arbitrary File UploadEPSS 3.2%CVE-2017-16772—Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 alloEPSS 3.2%CVE-2024-23946MEDIUMApache OFBiz: Path traversal or file inclusionEPSS 3.1%CVE-2026-24897CRITICALAuthenticated Remote Code Execution via Arbitrary File UploadEPSS 3.1%