Falhas do tipo CWE-434

3.066 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2025-7441CRITICALStoryChief <= 1.0.42 - Unauthenticated Arbitrary File UploadEPSS 39.5%CVE-2022-0888CRITICALNinja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File UploadEPSS 39.4%CVE-2021-26828HIGHOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP fEPSS 39.4%KEVCVE-2022-46020CRITICALWBCE CMS v1.5.4 can implement getshell by modifying the upload file type.EPSS 39.0%CVE-2022-4732MEDIUMUnrestricted Upload of File with Dangerous Type in microweber/microweberEPSS 38.2%CVE-2021-32955—Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.EPSS 37.3%CVE-2024-9932CRITICALWux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File UploadEPSS 36.4%CVE-2022-47878CRITICALIncorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specifyEPSS 35.7%CVE-2024-6220CRITICAL简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File UploadEPSS 35.5%CVE-2020-13671HIGHDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extenEPSS 35.4%KEVCVE-2023-5145MEDIUMD-Link DAR-7000 licence.php unrestricted uploadEPSS 34.3%CVE-2022-48194HIGHTP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoSEPSS 33.5%CVE-2023-5146MEDIUMD-Link DAR-7000/DAR-8000 updatelib.php unrestricted uploadEPSS 32.9%CVE-2023-2523HIGHWeaver E-Office unrestricted uploadEPSS 32.9%CVE-2026-1357CRITICALMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File UploadEPSS 32.7%CVE-2024-57968CRITICALAdvantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessibleEPSS 32.3%KEVCVE-2025-6440CRITICALWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File UploadEPSS 31.4%CVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 31.1%CVE-2026-56290CRITICALJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0EPSS 30.9%CVE-2024-56064CRITICALWordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerabilityEPSS 30.8%