Weakness (CWE)
CWE-646: Reliance on File Name or Extension of Externally-Supplied File
Base Incomplete
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors.
More detail
This could be used by attackers to cause the file to be
misclassified and processed in a dangerous fashion, causing
the wrong action to occur.
How to prevent it (1 mitigation)
-
Architecture and Design
Make decisions on the server side based on file content and not on file name or extension.
Source: MITRE CWE-646
1 result · Clear filters · Feed
-
Medium 5.3CVE-2025-1716 Public exploit
picklescan - Security scanning bypass via 'pip main'
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted gl…