Falhas do tipo CWE-434

3.244 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2025-1128CRITICALEverest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and DeletionEPSS 42.4%CVE-2021-24284—Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File UploadEPSS 42.1%CVE-2024-42640CRITICALangular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerabiEPSS 40.2%CVE-2021-27860CRITICALArbitrary file upload vulnerability in FatPipe softwareEPSS 39.7%KEVCVE-2022-0888CRITICALNinja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File UploadEPSS 39.4%CVE-2021-26828HIGHOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP fEPSS 39.1%KEVCVE-2022-46020CRITICALWBCE CMS v1.5.4 can implement getshell by modifying the upload file type.EPSS 39.0%CVE-2024-9932CRITICALWux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File UploadEPSS 38.4%CVE-2022-4732MEDIUMUnrestricted Upload of File with Dangerous Type in microweber/microweberEPSS 38.2%CVE-2021-32955—Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.EPSS 37.3%CVE-2020-13671HIGHDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extenEPSS 36.2%KEVCVE-2022-47878CRITICALIncorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specifyEPSS 35.7%CVE-2024-6220CRITICAL简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File UploadEPSS 35.5%CVE-2026-1357CRITICALMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File UploadEPSS 35.1%CVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 35.1%CVE-2023-5145MEDIUMD-Link DAR-7000 licence.php unrestricted uploadEPSS 34.2%CVE-2022-48194HIGHTP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoSEPSS 33.5%CVE-2025-6440CRITICALWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File UploadEPSS 33.3%CVE-2024-56064CRITICALWordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerabilityEPSS 33.2%CVE-2023-2523HIGHWeaver E-Office unrestricted uploadEPSS 32.9%