Falhas do tipo CWE-434

3.246 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2022-43304CRITICALThe d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code eEPSS 1.4%CVE-2023-48031CRITICALOpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass securEPSS 1.4%CVE-2022-38877HIGHGarage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1.EPSS 1.4%CVE-2025-4336HIGHeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()EPSS 1.4%CVE-2020-26286HIGHArbitary file uploadEPSS 1.4%CVE-2023-6316CRITICALMW WP Form <= 5.0.1 - Unauthenticated Arbitrary File UploadEPSS 1.4%CVE-2024-8525CRITICALAutomated Logic WebCTRL and Carrier i-Vu Unrestricted File UploadEPSS 1.4%CVE-2024-11617CRITICALEnvolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_fileEPSS 1.4%CVE-2022-40341HIGHmojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafEPSS 1.4%CVE-2023-31541CRITICALA unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine,EPSS 1.4%CVE-2022-41537HIGHOnline Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operaEPSS 1.4%CVE-2022-31366HIGHAn arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execuEPSS 1.4%CVE-2024-8958HIGHUnrestricted File Write and Read in composiohq/composioEPSS 1.4%CVE-2022-25277HIGHDrupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots froEPSS 1.4%CVE-2022-2268—WP All Import < 3.6.8 - Admin+ Arbitrary File UploadEPSS 1.4%CVE-2022-0242HIGHUnrestricted Upload of File with Dangerous Type in crater-invoice/craterEPSS 1.4%CVE-2023-33508CRITICALKramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).EPSS 1.4%CVE-2022-41406HIGHAn arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute arEPSS 1.4%CVE-2023-29384CRITICALWordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File UploadEPSS 1.4%CVE-2024-22426HIGHDell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker couEPSS 1.4%