Incomplete Identification of Uploaded File Variables (PHP)
CWE-616
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type).
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Architecture and Design: If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile']))
- Implementation: For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.
Latest Incomplete Identification of Uploaded File Variables (PHP) vulnerabilities
- 8.7 High severity
plane: Improper Neutralization of Input During Web Page Generation
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and t
- 7.5 High severity
perspective: Incomplete Identification of Uploaded File Variables (PHP)
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed
- 9.9 Critical severity
Invoiceplane: Incomplete Identification of Uploaded File Variables (PHP)
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
- 8.8 High severity
WebErpMesv2: Unrestricted Upload of File with Dangerous Type
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, inclu
- 9.8 Critical severity
panalog: Incomplete Identification of Uploaded File Variables (PHP)
An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows attackers to execute arbitrary code via the exportpdf.php component.
- 7.2 High severity
wbce_cms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.