Unrestricted Upload of File with Dangerous Type
CWE-434
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
We track 2,513 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 28 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
- Architecture and Design: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- Architecture and Design: Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
- Architecture and Design: Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing.html or.htm file types.
- Implementation: Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that filename.php.gif is fed to the PHP interpreter.
Latest Unrestricted Upload of File with Dangerous Type vulnerabilities
- 8.8 High severity
Betheme: Unrestricted Upload of File with Dangerous Type
The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating
- 7.2 High severity
Openstamanager: Unrestricted Upload of File with Dangerous Type
OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)
- 7.3 High severity
funadmin: Improper Access Control
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestrict
- 7.3 High severity
MindsDB: Improper Access Control
A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack c
- 7.2 High severity
CTMS: Unrestricted Upload of File with Dangerous Type
CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 9.8 Critical severity
User Registration Advanced Fields: Unrestricted Upload of File with Dangerous Type
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthent
- 9.8 Critical severity
E-office: Unrestricted Upload of File with Dangerous Type
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary fi
- 8.1 High severity
Drag and Drop File Upload for Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Drag and Drop File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.1.3. This is due to the plugin extracting the file extension before sanitization occurs and allowing the file type
- 8.8 High severity
Flowise: Unrestricted Upload of File with Dangerous Type
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even
- 9.8 Critical severity
Borg SPM 2007: Unrestricted Upload of File with Dangerous Type
Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the serve
- 9.8 Critical severity
Breeze Cache: Unrestricted Upload of File with Dangerous Type
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to
- 7.2 High severity
Security Verify Directory (Container): Unrestricted Upload of File with Dangerous Type
IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims
- 7.2 High severity
Visitor Management System: Unrestricted Upload of File with Dangerous Type
Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an au
- 9.1 Critical severity
Vvveb CMS: Unrestricted Upload of File with Dangerous Type
Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. At
- 8.8 High severity
Vvveb CMS: Unrestricted Upload of File with Dangerous Type
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extens
- 8.8 High severity
magento-lts: Unrestricted Upload of File with Dangerous Type
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload
- 7.3 High severity
Hospital Management System: Improper Access Control
A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /backend/admin/his_admin_account.php. The manipulation of the argument ad_dpic results in unrestricted up
- 7.3 High severity
langflow: Improper Access Control
A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload
- 8.8 High severity
CMP – Coming Soon & Maintenance Plugin by…: Unrestricted Upload of File with Dangerous Type
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the func
- 9.0 Critical severity
postiz-app: Improper Neutralization of Input During Web Page Generation
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded
- 9.1 Critical severity
CRM: Improper Privilege Management
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopy
- 8.1 High severity
Drag and Drop Multiple File Upload for Contact…: Unrestricted Upload of File with Dangerous Type
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are config
- 8.7 High severity
note-mark: Improper Neutralization of Input During Web Page Generation
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHT
- 8.0 High severity
weblate: Relative Path Traversal
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If dev
- 9.8 Critical severity
WebStack: Unrestricted Upload of File with Dangerous Type
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary
- 8.8 High severity
Pachno: Unrestricted Upload of File with Dangerous Type
Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files .php5 scripts to web-
- 7.2 High severity
Pandora FMS: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800
- 8.8 High severity
chamilo-lms: Unrestricted Upload of File with Dangerous Type
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the
- 8.8 High severity
chamilo-lms: Unrestricted Upload of File with Dangerous Type
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/
- 9.8 Critical severity
ProSolution WP Client: Unrestricted Upload of File with Dangerous Type
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attack
- 7.2 High severity
Gerador de Certificados – DevApps: Unrestricted Upload of File with Dangerous Type
The Gerador de Certificados – DevApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moveUploadedFile() function in all versions up to, and including, 1.3.6. This makes it possible for authenticated atta
- 9.8 Critical severity
DSGVO Google Web Fonts GDPR: Unrestricted Upload of File with Dangerous Type
The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_no
- 7.2 High severity
MATCHA INVOICE: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server
- 9.1 Critical severity
CRM: Improper Limitation of a Pathname to a Restricted Directory
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apac
- 9.8 Critical severity
Ninja Forms - File Uploads: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible
- 7.2 High severity
chyrp-lite: Improper Limitation of a Pathname to a Restricted Directory
Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vuln
- 8.8 High severity
BraveCMS-2.0: Unrestricted Upload of File with Dangerous Type
Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It is found in app/Http/Controllers/Dashboard/CkEditorController.php within the ckupload method. The method fails to validat
- 9.8 Critical severity
BraveCMS-2.0: Unrestricted Upload of File with Dangerous Type
Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentiall
- 9.8 Critical severity
HI-LED-WR120-G2: Improper Access Control
A weakness has been identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This impacts an unknown function of the file /fs. Executing a manipulation of the argument cwd can lead to unrestricted upload. The attack can be launched remotely. The exploit has
- 8.8 High severity
Biztalk360: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to ac