Falhas do tipo CWE-434

3.099 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2025-27127MEDIUMA vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally IntegratedEPSS 0.3%CVE-2025-67707MEDIUMUnvalidated File Upload vulnerability in ArcGIS Server.EPSS 0.3%CVE-2026-2213MEDIUMcode-projects Online Music Site AdminAddAlbum.php unrestricted uploadEPSS 0.3%CVE-2025-11020HIGHRemote Code Execution in MarkAny SafePC EnterpriseEPSS 0.3%CVE-2025-49222MEDIUMMattermost Shared Channel Upload Type Validation BypassEPSS 0.3%CVE-2024-50620HIGHUnrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CEPSS 0.3%CVE-2026-80050HIGHContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload EndpointsEPSS 0.3%CVE-2026-32989HIGHPrecurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file uploadEPSS 0.3%CVE-2025-31048CRITICALWordPress Shopo <= 1.1.4 - Arbitrary File Upload VulnerabilityEPSS 0.3%CVE-2026-87928MEDIUMMaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_pageEPSS 0.3%CVE-2026-5695HIGHMultiple vulnerabilities in the Microweber administration panelEPSS 0.3%CVE-2025-62618HIGHELOG file upload stored XSSEPSS 0.3%CVE-2026-42538MEDIUMIRIS has an Insecure File UploadEPSS 0.3%CVE-2025-9314CRITICALDeveloper Tools <= 1.1.3 – Unauthenticated Arbitrary File UploadEPSS 0.3%CVE-2026-46426HIGHBudibase: Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2025-55267MEDIUMHCL Aftermarket DPC is affected by Unrestricted File Upload vulnerabilityEPSS 0.3%CVE-2025-54460HIGHAVEVA PI Integrator Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2021-47899MEDIUMYetiShare File Hosting Script 5.1.0 Remote File Upload SSRF VulnerabilityEPSS 0.3%CVE-2025-66837MEDIUMA file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/MalwareEPSS 0.3%CVE-2025-54693CRITICALWordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload VulnerabilityEPSS 0.3%