Unrestricted Upload of File with Dangerous Type
CWE-434
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
We track 2,513 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 28 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
- Architecture and Design: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- Architecture and Design: Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
- Architecture and Design: Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing.html or.htm file types.
- Implementation: Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that filename.php.gif is fed to the PHP interpreter.
Latest Unrestricted Upload of File with Dangerous Type vulnerabilities
- 9.8 Critical severity
Sentcms: Unrestricted Upload of File with Dangerous Type
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload.
- 9.8 Critical severity
Sentcms: Unrestricted Upload of File with Dangerous Type
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload.
- 7.2 High severity
Catch Themes Demo Import: Unrestricted Upload of File with Dangerous Type
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML
- 7.8 High severity
Home Owners Collection Management System: Unrestricted Upload of File with Dangerous Type
A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file.
- 9.8 Critical severity
Home Owners Collection Management System: Unrestricted Upload of File with Dangerous Type
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- 8.8 High severity
Portfolio: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- 8.8 High severity
Portfolio: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
- 7.2 High severity
CMS Made Simple: Unrestricted Upload of File with Dangerous Type
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
- 7.2 High severity
Revolution: Unrestricted Upload of File with Dangerous Type
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
- 8.8 High severity
Fireware: Unrestricted Upload of File with Dangerous Type
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before
- 7.2 High severity
Zenario CMS: Unrestricted Upload of File with Dangerous Type
Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in
- 9.8 Critical severity
Zfaka: Unrestricted Upload of File with Dangerous Type
An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
- 8.8 High severity
Wikidocs: Unrestricted Upload of File with Dangerous Type
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php.
- 9.8 Critical severity
Jqueryform: Unrestricted Upload of File with Dangerous Type
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side,
- 7.2 High severity
Exponent CMS: Unrestricted Upload of File with Dangerous Type
Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}.php" from where can be accessed in orde
- 9.8 Critical severity
Jspxcms: Unrestricted Upload of File with Dangerous Type
A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files.
- 8.8 High severity
Voipmonitor: Unrestricted Upload of File with Dangerous Type
The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
- 9.8 Critical severity
Mcms: Unrestricted Upload of File with Dangerous Type
MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
- 8.8 High severity
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit Exploited
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identif
- 8.8 High severity
Trend Micro Multiple Products Improper Input Validation Exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must firs
- 8.8 High severity
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Exploited
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
- 6.6 Medium severity
Microsoft Exchange Server Security Feature Bypass Exploited
Microsoft Exchange Server Security Feature Bypass Vulnerability
- 7.2 High severity
SonicWall Email Security Unrestricted Upload of File Exploited
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- 8.8 High severity
Drupal core Un-restricted Upload of File Exploited
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal
- 7.2 High severity
Ivanti Pulse Connect Secure Code Execution Exploited
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
- 9.8 Critical severity
WordPress File Manager Plugin Remote Code Execution Exploited
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to
- 8.8 High severity
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Exploited
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver
- 6.5 Medium severity
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Exploited
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
- 9.8 Critical severity
Adobe ColdFusion Unrestricted File Upload Exploited
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
- 8.1 High severity
Apache Tomcat Remote Code Execution Exploited
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file
- 8.1 High severity
Apache Tomcat on Windows Remote Code Execution Exploited
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could the
- 9.8 Critical severity
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Exploited
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
- 9.8 Critical severity
Apache ActiveMQ Improper Input Validation Exploited
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.