Falhas do tipo CWE-434

3.098 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2026-14698MEDIUMSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted uploadEPSS 0.4%CVE-2026-91849MEDIUMWuzhiCMS Avatar Upload index.php setAvatar unrestricted uploadEPSS 0.4%CVE-2026-14776MEDIUMSourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted uploadEPSS 0.4%CVE-2026-90857MEDIUMSourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted uploadEPSS 0.4%CVE-2026-11344MEDIUMcode-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted uploadEPSS 0.4%CVE-2025-15423MEDIUMEmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted uploadEPSS 0.4%CVE-2026-85186MEDIUMitsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted uploadEPSS 0.4%CVE-2026-77681MEDIUMCodeAstro Online Job Portal update-profile.php unrestricted uploadEPSS 0.4%CVE-2026-82679MEDIUMdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploadEPSS 0.4%CVE-2025-10085MEDIUMSourceCodester Pet Grooming Management Software manage_website.php unrestricted uploadEPSS 0.4%CVE-2026-1742MEDIUMEFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.4%CVE-2023-43619—An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/autEPSS 0.4%CVE-2026-29104LOWSuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRMEPSS 0.4%CVE-2025-12862MEDIUMprojectworlds Online Notes Sharing Platform userprofile.php unrestricted uploadEPSS 0.4%CVE-2024-34021MEDIUMUnrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploadeEPSS 0.4%CVE-2024-13355MEDIUMAdmin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site ScriptingEPSS 0.4%CVE-2025-64374CRITICALWordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2024-13133MEDIUMZeroWdd studentmanager StudentController. java editStudent unrestricted uploadEPSS 0.4%CVE-2025-36174HIGHIBM Integrated Analytics System file uploadEPSS 0.4%CVE-2025-7190MEDIUMcode-projects Library Management System student_edit_photo.php unrestricted uploadEPSS 0.4%