Skip to content
OpenAdvisories

Weakness (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

Base Draft

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

How to prevent it (8 mitigations)

  1. Architecture and Design

    Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]

  2. Architecture and Design

    When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

  3. Architecture and Design

    Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]

  4. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.

  5. Architecture and Design

    Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.

  6. Implementation

    Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]

  7. Implementation

    When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.

  8. Architecture and Design

    For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE-434

All Critical High Medium Low Exploited only Public exploit

220 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-34111 Public exploit

    Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE

    An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts…

    Tiki Software Community Association Wiki CMS Groupware
  • Critical 9.4
    CVE-2025-34104 Public exploit

    Piwik Authenticated RCE via Custom Plugin Upload

    An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP …

    Piwik (now Matomo) Web Analytics Platform
  • Critical 9.8
    CVE-2025-7340 Public exploit Scanner template

    HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

    The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2…

    HT Plugins HT Contact Form – Drag & Drop Form Builder for WordPress Web / CMS
  • Critical 9.8
    CVE-2020-36849 Public exploit

    AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload

    The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it po…

    AIT Themes AIT CSV import/export Web / CMS
  • Critical 9.8
    CVE-2020-36847 Public exploit Scanner template EPSS 59%

    Simple File List < 4.2.3 - Remote Code Execution

    The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthentic…

    eemitch Simple File List Web / CMS
  • Critical 9.8
    CVE-2025-6058 Public exploit Scanner template

    WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

    The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for…

    Iqonic Design WPBookit Web / CMS
  • Critical 9.3
    CVE-2025-34100 Public exploit

    BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload

    An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload …

    BuilderEngine CMS
  • Critical 10.0
    CVE-2025-34077 Public exploit Scanner template EPSS 17%

    WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE

    An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manip…

    Genetech Solutions WordPress Pie Register Plugin Web / CMS
  • Critical 9.1
    CVE-2025-23968 Public exploit

    WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through <= 1.9.

    webfactory AiBud WP
  • Critical 10.0
    CVE-2025-34040 Public exploit Scanner template EPSS 15%

    Seeyon Zhiyuan OA System Path Traversal File Upload

    An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JS…

    Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) Zhiyuan OA Web Application System
  • Critical 9.9
    CVE-2025-46157 Public exploit

    An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment functio…

  • Critical 10.0
    CVE-2025-49071 Public exploit

    WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flozen: from n/a through < 1.5.1.

    NasaTheme Flozen
  • Critical 9.8
    CVE-2025-5058 Public exploit

    eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()

    The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated at…

    eMagicOne eMagicOne Store Manager for WooCommerce Web / CMS
  • Critical 10.0
    CVE-2025-39401 Public exploit

    WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

    mojoomla WPAMS
  • Critical 10.0
    CVE-2025-47577 Public exploit Scanner template

    WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Critical 9.9
    CVE-2025-26892 Public exploit

    WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.

    dkszone Celestial Aura
  • Critical 9.8
    CVE-2025-4389 Public exploit

    Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload

    The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes i…

    CodeRevolution Crawlomatic Multipage Scraper Post Generator Web / CMS
  • Critical 9.8
    CVE-2025-4403 Public exploit

    Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

    The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing …

    glenwpcoder Drag and Drop Multiple File Upload for WooCommerce Web / CMS
  • Critical 9.1
    CVE-2025-47549 Public exploit

    WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.

    themefic BEAF
  • Critical 10.0
    CVE-2025-31324 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…

    SAP SAP NetWeaver (Visual Composer development server)
    KEV Apr 29, 2025
  • Critical 9.9
    CVE-2025-32682 Public exploit

    WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.

    RomanCode MapSVG
  • Critical 9.1
    CVE-2025-39436 Public exploit

    WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <= 1.0.

    aidraw I Draw
  • Critical 9.9
    CVE-2025-32579 Public exploit

    WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts sync-posts allows Upload a Web Shell to a Web Server.This issue affects Sync Posts: from n/a through <= 1.0.

    SoftClever Sync Posts
  • Critical 9.1
    CVE-2025-32206 Public exploit

    WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This issue affects Processing Projects: from n/a through <= 1.0.2.

    LABCAT Processing Projects
  • Critical 9.9
    CVE-2025-32140 Public exploit

    WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnail allows Upload a Web Shell to a Web Server.This issue affects WP Remote Thumbnail: from n/a through <= 1.3.2.

    Nirmal Kumar Ram WP Remote Thumbnail
  • Critical 9.1
    CVE-2025-32118 Public exploit

    WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through <= 4.1.14.

    NiteoThemes CMP – Coming Soon & Maintenance
  • Critical 9.8
    CVE-2025-2005 Public exploit EPSS 22%

    Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

    The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated at…

    Rustaurius Front End Users Web / CMS
  • Critical 9.8
    CVE-2025-2512 Public exploit

    File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function

    The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated …

    Thom Stark File Away Web / CMS
  • Critical 9.1
    CVE-2025-28915 Public exploit

    WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This issue affects ThemeEgg ToolKit: from n/a through <= 1.2.9.

    Theme Egg ThemeEgg ToolKit
  • Critical 9.8
    CVE-2025-26319 Public exploit Scanner template EPSS 56%

    FlowiseAI Flowise arbitrary file upload vulnerability

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    flowise npm
  • Critical 9.8
    CVE-2024-8425 Public exploit Scanner template

    WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload

    The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including,…

    WP Swings WooCommerce Ultimate Gift Card Web / CMS
  • Critical 9.1
    CVE-2025-23942 Public exploit

    WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This issue affects WP Load Gallery: from n/a through <= 2.1.6.

    ngocuct0912 WP Load Gallery
  • Critical 9.8
    CVE-2024-48760 Public exploit EPSS 46%

    An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attack…

  • Critical 9.1
    CVE-2024-56249 Public exploit

    WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.

    Ludwig You WPMasterToolKit
  • Critical 10.0
    CVE-2024-56064 Public exploit Scanner template EPSS 33%

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

    azzaroco WP SuperBackup
  • Critical 9.9
    CVE-2024-54262 Public exploit

    WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

    sidngr Import Export For WooCommerce Web / CMS
  • Critical 9.8
    CVE-2024-9290 Public exploit

    Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

    The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, …

    azzaroco Super Backup & Clone - Migrate for WordPress Web / CMS
  • Critical 9.5
    CVE-2024-53677 Public exploit EPSS 72%

    Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

    File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affec…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.9
    CVE-2024-52429 Public exploit

    WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through <= 2.0.

    AntonHoelstad WP Quick Setup
  • Critical 9.8
    CVE-2024-8856 Public exploit Scanner template EPSS 94%

    Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

    The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. Th…

    revmakx Backup and Staging by WP Time Capsule Web / CMS