Skip to content
OpenAdvisories

Weakness (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

Base Draft

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

How to prevent it (8 mitigations)

  1. Architecture and Design

    Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]

  2. Architecture and Design

    When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

  3. Architecture and Design

    Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]

  4. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.

  5. Architecture and Design

    Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.

  6. Implementation

    Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]

  7. Implementation

    When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.

  8. Architecture and Design

    For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE-434

All Critical High Medium Low Exploited only Public exploit

220 results · Clear filters · Feed

  • Critical 10.0
    CVE-2024-52375 Public exploit

    WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This issue affects Datasets Manager by Arttia Creative: from n/a through <= 1.5.

    Arttia Creative Datasets Manager by Arttia Creative
  • Critical 10.0
    CVE-2024-52380 Public exploit

    WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affects Picsmize: from n/a through <= 1.0.0.

    softpulseinfotech Picsmize
  • Critical 10.0
    CVE-2024-51788 Public exploit

    WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web Shell to a Web Server.This issue affects The Novel Design Store Directory: from n/a through <= 4.3.0.

    Joshua Wolfe The Novel Design Store Directory
  • Critical 10.0
    CVE-2024-51791 Public exploit

    WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.8.0.

    Made I.T. Forms
  • Critical 10.0
    CVE-2024-51793 Public exploit

    WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This issue affects RepairBuddy: from n/a through <= 3.8115.

    Ateeq Rafeeq RepairBuddy
  • Critical 10.0
    CVE-2024-50526 Public exploit

    WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.

    Lindeni Mahlalela Multi Purpose Mail Form
  • Critical 10.0
    CVE-2024-50510 Public exploit

    WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.

    webandprint AR for WooCommerce Web / CMS
  • Critical 9.9
    CVE-2024-50427 Public exploit

    WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through <= 1.9.136.

    devsoftbaltic SurveyJS
  • Critical 10.0
    CVE-2024-50473 Public exploit

    WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.3.

    Ajar Productions Ajar in5 Embed
  • Critical 10.0
    CVE-2024-50482 Public exploit

    WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

    Chetan Khandla Woocommerce Product Design Web / CMS
  • Critical 10.0
    CVE-2024-50493 Public exploit

    WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.

    masterhomepage Automatic Translation
  • Critical 9.8
    CVE-2024-50623 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file u…

    KEV Dec 13, 2024
  • Critical 9.8
    CVE-2024-9932 Public exploit EPSS 38%

    Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

    The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to u…

    jurredeklijn Wux Blog Editor Web / CMS
  • Critical 9.9
    CVE-2024-49653 Public exploit

    WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affects Portfolleo: from n/a through <= 1.2.

    james-eggers Portfolleo
  • Critical 10.0
    CVE-2024-49668 Public exploit

    WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows Upload a Web Shell to a Web Server.This issue affects Verbalize WP: from n/a through <= 1.0.

    christopherdewese1099 Verbalize WP
  • Critical 10.0
    CVE-2024-49607 Public exploit

    WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through <= 1.0.

    redhopit WP Dropbox Dropins
  • Critical 9.8
    CVE-2016-15042 Public exploit Scanner template

    Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

    The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJA…

    N-Media Frontend File Manager Plugin N-Media Post Front-end Form
  • Critical 9.8
    CVE-2024-42640 Public exploit Scanner template EPSS 40%

    angular-base64-upload vulnerable to unauthenticated remote code execution

    angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uplo…

    angular-base64-upload npm
  • Critical 9.8
    CVE-2024-46377 Public exploit

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function…

  • Critical 10.0
    CVE-2024-27115 Public exploit Scanner template

    Remote Code Execution through File Upload in SOPlanning before 1.52.02

    A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. Th…

    Simple Online Planning SO Planning
  • Critical 9.8
    CVE-2024-44849 Public exploit Scanner template EPSS 46%

    Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

  • Critical 10.0
    CVE-2024-43160 Public exploit Scanner template

    WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6.

    BerqWP BerqWP
  • Critical 9.9
    CVE-2024-37762 Public exploit

    MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code executi…

  • Critical 9.8
    CVE-2024-6127 Public exploit EPSS 10%

    BC Security Empire Path Traversal RCE

    BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, a…

    BC-SECURITY Empire
  • Critical 9.8
    CVE-2024-34833 Public exploit

    Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_setti…

  • Critical 9.8
    CVE-2024-3912 Public exploit

    ASUS Router - Upload arbitrary firmware

    Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

    ASUS DSL-AC750 DSL-N16 DSL-AC51
  • Critical 9.8
    CVE-2024-31777 Public exploit

    File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted fi…

  • Critical 9.8
    CVE-2024-5084 Public exploit Scanner template EPSS 51%

    Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

    The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthentica…

    HashThemes Hash Form – Drag & Drop Form Builder Web / CMS
  • Critical 10.0
    CVE-2024-31351 Public exploit

    WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.6.

    Copymatic Copymatic – AI Content Writer & Generator
  • Critical 9.1
    CVE-2024-32002 Public exploit EPSS 29%

    Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule'…

    git git git git Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 10.0
    CVE-2024-32700 Public exploit

    WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Kognetiks Kognetiks Chatbot for WordPress.This issue affects Kognetiks Chatbot for WordPress: from n/a through 2.0.0.

    kognetiks Kognetiks Chatbot for WordPress Web / CMS
  • Critical 9.8
    CVE-2024-2667 Public exploit Scanner template

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

    The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. T…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS
  • Critical 10.0
    CVE-2023-51409 Public exploit Scanner template EPSS 63%

    WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.

    Jordy Meow AI Engine: ChatGPT Chatbot
  • Critical 9.7
    CVE-2024-31214 Public exploit EPSS 18%

    Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution

    Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is st…

    traccar traccar
  • Critical 9.1
    CVE-2024-31114 Public exploit

    WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5.

    biplob018 Shortcode Addons
  • Critical 9.9
    CVE-2023-48777 Public exploit Scanner template

    WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.

    Elementor.com Elementor Website Builder
  • Critical 9.1
    CVE-2023-29386 Public exploit

    WordPress Manager for Icomoon plugin <= 2.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0.

    Julien Crego Manager for Icomoon
  • Critical 9.1
    CVE-2024-26503 Public exploit

    Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to…

  • Critical 9.8
    CVE-2024-27747 Public exploit EPSS 24%

    File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a cr…

  • Critical 9.1
    CVE-2024-22393 Public exploit

    Apache Answer: Pixel Flood Attack by uploading the large pixel file

    Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by upl…

    Apache Software Foundation Apache Answer github.com/apache/incubator-answer Go