Skip to content
OpenAdvisories

Weakness (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

Base Draft

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

How to prevent it (8 mitigations)

  1. Architecture and Design

    Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]

  2. Architecture and Design

    When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

  3. Architecture and Design

    Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]

  4. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.

  5. Architecture and Design

    Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.

  6. Implementation

    Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]

  7. Implementation

    When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.

  8. Architecture and Design

    For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE-434

All Critical High Medium Low Exploited only Public exploit

414 results · Clear filters · Feed

  • Medium 6.6
    CVE-2024-56264 Public exploit

    WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue affects ACF City Selector: from n/a through <= 1.14.0.

    Beee ACF City Selector
  • Critical 9.1
    CVE-2024-56249 Public exploit

    WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.

    Ludwig You WPMasterToolKit
  • Critical 10.0
    CVE-2024-56064 Public exploit Scanner template EPSS 33%

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

    azzaroco WP SuperBackup
  • High 7.2
    CVE-2024-9698 Public exploit

    Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files

    The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'process_uploaded_files' function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers,…

    aruphash Crafthemes Demo Import Web / CMS
  • Critical 9.9
    CVE-2024-54262 Public exploit

    WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

    sidngr Import Export For WooCommerce Web / CMS
  • Critical 9.8
    CVE-2024-9290 Public exploit

    Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

    The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, …

    azzaroco Super Backup & Clone - Migrate for WordPress Web / CMS
  • Critical 9.5
    CVE-2024-53677 Public exploit EPSS 72%

    Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

    File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affec…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • High 8.8
    CVE-2024-10578 Public exploit

    Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation

    The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This makes it possible for a…

    blazethemes Pubnews Web / CMS
  • Critical 9.9
    CVE-2024-52429 Public exploit

    WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through <= 2.0.

    AntonHoelstad WP Quick Setup
  • Critical 9.8
    CVE-2024-8856 Public exploit Scanner template EPSS 94%

    Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

    The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. Th…

    revmakx Backup and Staging by WP Time Capsule Web / CMS
  • Critical 10.0
    CVE-2024-52375 Public exploit

    WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This issue affects Datasets Manager by Arttia Creative: from n/a through <= 1.5.

    Arttia Creative Datasets Manager by Arttia Creative
  • Critical 10.0
    CVE-2024-52380 Public exploit

    WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affects Picsmize: from n/a through <= 1.0.0.

    softpulseinfotech Picsmize
  • High 8.7
    CVE-2024-52302 Public exploit

    common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)

    common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint a…

    OsamaTaher Java-springboot-codebase
  • Critical 10.0
    CVE-2024-51788 Public exploit

    WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web Shell to a Web Server.This issue affects The Novel Design Store Directory: from n/a through <= 4.3.0.

    Joshua Wolfe The Novel Design Store Directory
  • Critical 10.0
    CVE-2024-51791 Public exploit

    WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.8.0.

    Made I.T. Forms
  • Critical 10.0
    CVE-2024-51793 Public exploit

    WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This issue affects RepairBuddy: from n/a through <= 3.8115.

    Ateeq Rafeeq RepairBuddy
  • Critical 10.0
    CVE-2024-50526 Public exploit

    WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.

    Lindeni Mahlalela Multi Purpose Mail Form
  • Critical 10.0
    CVE-2024-50510 Public exploit

    WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.

    webandprint AR for WooCommerce Web / CMS
  • High 7.5
    CVE-2024-7985 Public exploit

    FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload

    The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it pos…

    Softaculous FileOrganizer – WordPress File Manager Web / CMS
  • Critical 9.9
    CVE-2024-50427 Public exploit

    WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through <= 1.9.136.

    devsoftbaltic SurveyJS
  • Critical 10.0
    CVE-2024-50473 Public exploit

    WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.3.

    Ajar Productions Ajar in5 Embed
  • Critical 10.0
    CVE-2024-50482 Public exploit

    WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

    Chetan Khandla Woocommerce Product Design Web / CMS
  • Critical 10.0
    CVE-2024-50493 Public exploit

    WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.

    masterhomepage Automatic Translation
  • High 8.8
    CVE-2024-48594 Public exploit

    File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the …

  • Medium 6.3
    CVE-2024-10410 Public exploit

    SourceCodester Online Hotel Reservation System controller.php upload unrestricted upload

    A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads t…

    SourceCodester Online Hotel Reservation System
  • Critical 9.8
    CVE-2024-50623 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file u…

    KEV Dec 13, 2024
  • Critical 9.8
    CVE-2024-9932 Public exploit EPSS 38%

    Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

    The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to u…

    jurredeklijn Wux Blog Editor Web / CMS
  • Critical 9.9
    CVE-2024-49653 Public exploit

    WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affects Portfolleo: from n/a through <= 1.2.

    james-eggers Portfolleo
  • Critical 10.0
    CVE-2024-49668 Public exploit

    WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows Upload a Web Shell to a Web Server.This issue affects Verbalize WP: from n/a through <= 1.0.

    christopherdewese1099 Verbalize WP
  • Critical 10.0
    CVE-2024-49607 Public exploit

    WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through <= 1.0.

    redhopit WP Dropbox Dropins
  • High 8.8
    CVE-2020-36842 Public exploit

    Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload

    The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to u…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • Critical 9.8
    CVE-2016-15042 Public exploit Scanner template

    Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

    The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJA…

    N-Media Frontend File Manager Plugin N-Media Post Front-end Form
  • Critical 9.8
    CVE-2024-42640 Public exploit Scanner template EPSS 40%

    angular-base64-upload vulnerable to unauthenticated remote code execution

    angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uplo…

    angular-base64-upload npm
  • High 7.7
    CVE-2024-47823 Public exploit

    Livewire Remote Code Execution (RCE) on File Uploads

    Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual fi…

    livewire livewire livewire/livewire Packagist
  • Medium 6.8
    CVE-2024-8743 Public exploit

    Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload

    The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file …

    bitpressadmin File Manager Web / CMS
  • Critical 9.8
    CVE-2024-46377 Public exploit

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function…

  • Critical 10.0
    CVE-2024-27115 Public exploit Scanner template

    Remote Code Execution through File Upload in SOPlanning before 1.52.02

    A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. Th…

    Simple Online Planning SO Planning
  • High 7.5
    CVE-2024-8232 Public exploit EPSS 13%

    iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type

    SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.

    iniNet Solutions SpiderControl SCADA Web Server
  • High 7.2
    CVE-2024-44871 Public exploit EPSS 16%

    An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute …

  • Critical 9.8
    CVE-2024-44849 Public exploit Scanner template EPSS 46%

    Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.