Unrestricted Upload of File with Dangerous Type
CWE-434
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
We track 2,513 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 28 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
- Architecture and Design: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- Architecture and Design: Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
- Architecture and Design: Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing.html or.htm file types.
- Implementation: Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that filename.php.gif is fed to the PHP interpreter.
Latest Unrestricted Upload of File with Dangerous Type vulnerabilities
- 8.1 High severity
Gravity Forms: Unrestricted Upload of File with Dangerous Type
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form stat
- 10.0 Critical severity
Multi-tenant ERP System: Unrestricted Upload of File with Dangerous Type
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible di
- 9.8 Critical severity
WPLP Cookie Consent – Cookie Banner & Consent…: Unrestricted Upload of File with Dangerous Type
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization
- 7.3 High severity
ECShop: Improper Access Control
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. T
- 8.1 High severity
elFinder: Unrestricted Upload of File with Dangerous Type
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because th
- 10.0 Critical severity
WP Cookie Notice for GDPR, CCPA & ePrivacy…: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
- 8.9 High severity
Helix Ultimate extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uplo
- 7.3 High severity
Profile Builder Plugin: Improper Access Control
A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipul
- 8.8 High severity
bookstack: Unrestricted Upload of File with Dangerous Type
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extens
- 9.8 Critical severity
SigmaForms Pro – AI Generated Forms: Unrestricted Upload of File with Dangerous Type
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users du
- 7.5 High severity
One User Avatar | User Profile Picture: Unrestricted Upload of File with Dangerous Type
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_
- 9.4 Critical severity
JEM - Joomla Event Manager extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
- 8.8 High severity
Workeera: Unrestricted Upload of File with Dangerous Type
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload ar
- 9.8 Critical severity
ERP: Complete HR, Accounting & CRM Suite Built…: Unrestricted Upload of File with Dangerous Type
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension valid
- 8.8 High severity
Efence: Unrestricted Upload of File with Dangerous Type
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 9.8 Critical severity
EFence: Unrestricted Upload of File with Dangerous Type
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 7.2 High severity
CAYIN CMS-WS: Unrestricted Upload of File with Dangerous Type
CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.
- 7.2 High severity
QloApps: Unrestricted Upload of File with Dangerous Type
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve rem
- 9.8 Critical severity
Software Repository Management: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Re
- 8.8 High severity
CM Map Locations – Visualize and share your…: Unrestricted Upload of File with Dangerous Type
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type valida
- 8.8 High severity
adminer: Unrestricted Upload of File with Dangerous Type
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to co
- 7.3 High severity
Online Pharmacy System: Improper Access Control
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload
- 7.3 High severity
Payroll System: Improper Access Control
A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has bee
- 9.1 Critical severity
xshop: Unrestricted Upload of File with Dangerous Type
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achiev
- 9.4 Critical severity
vsDesk: Unrestricted Upload of File with Dangerous Type
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file,
- 8.7 High severity
ATutor: Unrestricted Upload of File with Dangerous Type
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a va
- 7.2 High severity
FDS 102: Unrestricted Upload of File with Dangerous Type
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise.
- 7.2 High severity
Depicter — Popup & Slider Builder: Unrestricted Upload of File with Dangerous Type
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including e
- 8.7 High severity
wekan: Unrestricted Upload of File with Dangerous Type
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the v
- 9.0 Critical severity
Elementor Pro: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
- 10.0 Critical severity
J-BusinessDirectory extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment,
- 10.0 Critical severity
Zoo extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
- 9.8 Critical severity
Joomla! CMS: Unrestricted Upload of File with Dangerous Type
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
- 9.8 Critical severity
Masteriyo - LMS: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2.
- 9.9 Critical severity
GP Premium: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5.
- 9.8 Critical severity
Forminator Forms – Contact Form, Payment Form…: Unrestricted Upload of File with Dangerous Type
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-exten
- 8.8 High severity
WordPress: Unrestricted Upload of File with Dangerous Type
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This is
- 7.2 High severity
ShareFile Storage Zones Controller: Improper Limitation of a Pathname to a Restricted Directory
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the applicati
- 8.8 High severity
Official Document Management System: Unrestricted Upload of File with Dangerous Type
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 9.8 Critical severity
ProSolution WP Client: Unrestricted Upload of File with Dangerous Type
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header