Skip to content
OpenAdvisories

Weakness (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

Base Draft

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

How to prevent it (8 mitigations)

  1. Architecture and Design

    Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]

  2. Architecture and Design

    When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

  3. Architecture and Design

    Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]

  4. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.

  5. Architecture and Design

    Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.

  6. Implementation

    Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]

  7. Implementation

    When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.

  8. Architecture and Design

    For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE-434

All Critical High Medium Low Exploited only Public exploit

414 results · Clear filters · Feed

  • High 8.1
    CVE-2025-3515 Public exploit Scanner template

    Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers…

    glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Web / CMS
  • High 7.2
    CVE-2025-6002 Public exploit

    VirtueMart - Unrestricted File Upload

    An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution …

    VirtueMart VirtueMart
  • High 7.3
    CVE-2025-5840 Public exploit

    SourceCodester Client Database Management System user_update_customer_order.php unrestricted upload

    A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_update_customer_order.php. The manipulation of the argument uploaded_file leads to unrestricte…

    SourceCodester Client Database Management System
  • High 8.8
    CVE-2025-3054 Public exploit

    WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload

    The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subs…

    wedevs WP User Frontend Pro Web / CMS
  • High 8.2
    CVE-2025-29093 Public exploit

    File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary co…

  • Medium 5.3
    CVE-2025-46080 Public exploit

    HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and c…

  • Medium 5.3
    CVE-2025-46078 Public exploit

    HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server

  • High 8.1
    CVE-2025-4336 Public exploit

    eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()

    The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated att…

    eMagicOne eMagicOne Store Manager for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2025-5058 Public exploit

    eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()

    The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated at…

    eMagicOne eMagicOne Store Manager for WooCommerce Web / CMS
  • Critical 10.0
    CVE-2025-39401 Public exploit

    WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

    mojoomla WPAMS
  • Critical 10.0
    CVE-2025-47577 Public exploit Scanner template

    WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Critical 9.9
    CVE-2025-26892 Public exploit

    WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.

    dkszone Celestial Aura
  • Critical 9.8
    CVE-2025-4389 Public exploit

    Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload

    The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes i…

    CodeRevolution Crawlomatic Multipage Scraper Post Generator Web / CMS
  • Critical 9.8
    CVE-2025-4403 Public exploit

    Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

    The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing …

    glenwpcoder Drag and Drop Multiple File Upload for WooCommerce Web / CMS
  • Medium 6.6
    CVE-2025-47550 Public exploit

    WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through <= 3.3.16.

    themefic Instantio
  • Critical 9.1
    CVE-2025-47549 Public exploit

    WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.

    themefic BEAF
  • Medium 6.3
    CVE-2025-3969 Public exploit

    codeprojects News Publishing Site Dashboard Edit Category Page edit-category.php unrestricted upload

    A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-category.php of the component Edit Category Page. The manipulation of the argument catego…

    code-projects News Publishing Site Dashboard
  • High 8.8
    CVE-2025-3914 Public exploit EPSS 17%

    Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload

    The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_downloader' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated a…

    aeropage Aeropage Sync for Airtable Web / CMS
  • Critical 10.0
    CVE-2025-31324 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…

    SAP SAP NetWeaver (Visual Composer development server)
    KEV Apr 29, 2025
  • High 8.8
    CVE-2025-3616 Public exploit

    Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload

    The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authentica…

    wpsoul Greenshift – animation and page builder blocks Web / CMS
  • Critical 9.9
    CVE-2025-32682 Public exploit

    WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.

    RomanCode MapSVG
  • Critical 9.1
    CVE-2025-39436 Public exploit

    WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <= 1.0.

    aidraw I Draw
  • Medium 6.6
    CVE-2025-39538 Public exploit

    WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Server.This issue affects WP-Advanced-Search: from n/a through <= 3.3.9.4.

    Mathieu Chartier WP-Advanced-Search
  • Critical 9.9
    CVE-2025-32579 Public exploit

    WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts sync-posts allows Upload a Web Shell to a Web Server.This issue affects Sync Posts: from n/a through <= 1.0.

    SoftClever Sync Posts
  • Critical 9.1
    CVE-2025-32206 Public exploit

    WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This issue affects Processing Projects: from n/a through <= 1.0.2.

    LABCAT Processing Projects
  • Critical 9.9
    CVE-2025-32140 Public exploit

    WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnail allows Upload a Web Shell to a Web Server.This issue affects WP Remote Thumbnail: from n/a through <= 1.3.2.

    Nirmal Kumar Ram WP Remote Thumbnail
  • High 8.8
    CVE-2025-29017 Public exploit

    A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upl…

  • Critical 9.1
    CVE-2025-32118 Public exploit

    WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through <= 4.1.14.

    NiteoThemes CMP – Coming Soon & Maintenance
  • Critical 9.8
    CVE-2025-2005 Public exploit EPSS 22%

    Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

    The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated at…

    Rustaurius Front End Users Web / CMS
  • High 8.8
    CVE-2025-2249 Public exploit

    SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

    The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel() function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attac…

    sojweb SoJ SoundSlides Web / CMS
  • Medium 6.1
    CVE-2025-2748 Public exploit Scanner template EPSS 61%

    Kentico Xperience stored cross-site scripting in multiple-file upload functionality

    The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

    Kentico Xperience
  • Critical 9.8
    CVE-2025-2512 Public exploit

    File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function

    The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated …

    Thom Stark File Away Web / CMS
  • High 8.6
    CVE-2025-24801 Public exploit EPSS 21%

    GLPI allows authenticated remote code execution

    GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.

    GLPI glpi glpi Ubuntu
  • Critical 9.1
    CVE-2025-28915 Public exploit

    WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This issue affects ThemeEgg ToolKit: from n/a through <= 1.2.9.

    Theme Egg ThemeEgg ToolKit
  • Critical 9.8
    CVE-2025-26319 Public exploit Scanner template EPSS 56%

    FlowiseAI Flowise arbitrary file upload vulnerability

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    flowise npm
  • Critical 9.8
    CVE-2024-8425 Public exploit Scanner template

    WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload

    The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including,…

    WP Swings WooCommerce Ultimate Gift Card Web / CMS
  • High 7.2
    CVE-2024-13869 Public exploit

    Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file

    The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible f…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • Critical 9.1
    CVE-2025-23942 Public exploit

    WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This issue affects WP Load Gallery: from n/a through <= 2.1.6.

    ngocuct0912 WP Load Gallery
  • Critical 9.8
    CVE-2024-48760 Public exploit EPSS 46%

    An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attack…

  • High 8.8
    CVE-2024-53345 Public exploit

    An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to e…