Unrestricted Upload of File with Dangerous Type
CWE-434
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
We track 2,513 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 28 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
- Architecture and Design: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- Architecture and Design: Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
- Architecture and Design: Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing.html or.htm file types.
- Implementation: Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that filename.php.gif is fed to the PHP interpreter.
Latest Unrestricted Upload of File with Dangerous Type vulnerabilities
- 8.4 High severity
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute…
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → S
- 8.5 High severity
Mitel MiVoice Office 400: Improper Limitation of a Pathname to a Restricted Directory
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the ba
- 8.8 High severity
wcms: Unrestricted Upload of File with Dangerous Type
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by
- 9.8 Critical severity
CVM: Unrestricted Upload of File with Dangerous Type
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating t
- 7.3 High severity
HospitalManagementSystem: Improper Access Control
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient o
- 7.2 High severity
yeswiki: Unrestricted Upload of File with Dangerous Type
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field reference
- 8.1 High severity
Ninja Forms - File Uploads: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and
- 9.1 Critical severity
GetSimpleCMS-CE: Cross-Site Request Forgery
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file
- 8.6 High severity
Pandora FMS: Unrestricted Upload of File with Dangerous Type
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
- 7.5 High severity
Pandora FMS: Cross-Site Request Forgery
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
- 7.5 High severity
Email Protection Gateway: Missing Authentication for Critical Functionality
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution,
- 7.2 High severity
Email Protection Gateway: Improper Control of Generation of Code
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on
- 8.8 High severity
yii2-starter-kit: Unrestricted Upload of File with Dangerous Type
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them
- 10.0 Critical severity
OrdaSoft Joomla CCK: Unrestricted Upload of File with Dangerous Type
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the
- 7.2 High severity
EasyFlow .NET: Unrestricted Upload of File with Dangerous Type
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 9.8 Critical severity
Zella Theme: Unrestricted Upload of File with Dangerous Type
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code exe
- 9.1 Critical severity
TMS7: Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
- 9.3 Critical severity
Agentflow 4.0: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
- 8.8 High severity
security-reporting: Improper Limitation of a Pathname to a Restricted Directory
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote
- 8.8 High severity
DDI Central: Unrestricted Upload of File with Dangerous Type
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.
- 8.8 High severity
DDI Central: Improper Privilege Management
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially
- 8.8 High severity
eBA Plus Document and Workflow Management System: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System
- 9.8 Critical severity
Ultra Addons for Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unau
- 8.1 High severity
AcyMailing Enterprise extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could emai
- 9.8 Critical severity
Request a Quote for WooCommerce: Unrestricted Upload of File with Dangerous Type
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the
- 8.1 High severity
GestSup: Unrestricted Upload of File with Dangerous Type
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, wh
- 9.1 Critical severity
Piwigo: Unrestricted Upload of File with Dangerous Type
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stor
- 9.8 Critical severity
PD45 Industrial Printer: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacke
- 8.8 High severity
PD45 Industrial Printer: External Control of File Name or Path
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to
- 8.6 High severity
Netlink ICT HG323RW Router: Unrestricted Upload of File with Dangerous Type
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a s
- 9.8 Critical severity
laravel-mediable: Unrestricted Upload of File with Dangerous Type
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits
- 7.3 High severity
CafeManagement: Improper Access Control
A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The ex
- 8.4 High severity
Administration panel: Unrestricted Upload of File with Dangerous Type
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by
- 7.3 High severity
php-file-manager-with-code-editor: Improper Access Control
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestric
- 7.3 High severity
php-file-manager-with-code-editor: Improper Access Control
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be
- 7.0 High severity
Tautulli: Improper Limitation of a Pathname to a Restricted Directory
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.f
- 8.6 High severity
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter…
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator coul
- 9.8 Critical severity
Web to Print Online Designer: Unrestricted Upload of File with Dangerous Type
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files
- 9.4 Critical severity
OrdaSoft Joomla Gallery free extension for…: Unrestricted Upload of File with Dangerous Type
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filenam
- 8.8 High severity
nivocart: Unrestricted Upload of File with Dangerous Type
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload