CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
facturascripts/facturascriptsPackagistFacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE9.9 Critical- easycorp easyadminbundleEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField7.6 High
- adobe commerce, commerce b2b, commerce events +5 more +7 moreAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)9.3 Critical
- julien040 anyqueryAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode9.1 Critical
- code-projects online job portalcode-projects Online Job Portal JobSeekerInsert.php unrestricted upload6.9 Medium
- churchcrm crmChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload9.1 Critical
- mozilla firefox for ios, firefox mobile +1 moreMalicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS5.3 Medium
- plank laravel-mediableLaravel-Mediable < 7.0.0 File Upload RCE via Extension Bypass7.7 High
- coderevolution aimogen proWordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability10.0 Critical
- quantumcloud woowbot pro maxWordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability9.9 Critical
- sourcecodester online book store systemSourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload5.1 Medium
- ragic enterprise cloud databaseRagic｜Enterprise Cloud Database - Arbitrary File Upload6.9 Medium
- area 17 twill cmsAREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload5.1 Medium
- hcr707305003 shiroiadminhcr707305003 shiroiAdmin FileController.php upload unrestricted upload6.9 Medium
- parse-community parse-serverParse Server 9.0.0 Stored XSS via malformed Content-Type2.1 Low
- rsjoomla rsfiles\!, rsjoomla.com rsfiles extension for joomla +1 moreJoomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.1210.0 Critical
- phoca download, phoca.cz phoca download extension for joomla +1 moreJoomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.39.0 Critical
- wp messiah swiss toolkit for wpSwiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()8.8 High
notrinos/notrinos-erpPackagistNotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)8.8 High- outstrip instant appointmentInstant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- wpazleen post export import with mediaPost Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import7.2 High
- webrehab super forms – drag & drop form builderSuper Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)9.8 Critical
- claris filemaker serverAn authenticated administrator may be able to achieve arbitrary code execution on the host system...4.9 Medium
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.110.0 Critical
- creativethemeshq blocksy companionBlocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter9.8 Critical
- bishopfox joroJoro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE9.6 Critical
- getgrav gravGrav - Arbitrary File Upload via Avatar Endpoint5.3 Medium
- creative themes blocksy companionBlocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments9.2 Critical
- globalprogramming whmcs bridge, whmcs bridge bridge +1 moreWHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter8.8 High
- totalbounty widget logic visualWidget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter8.8 High
- dataeaseDataEase H2 RCE via Zip Protocol & File Dropper Fix bypass8.7 High
- vtiger crmVtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module8.7 High
- vtiger crmVtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload8.6 High
- getwpfunnels wpfunnels – funnel builder for woocommerce with checkout & one click upsellWPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter9.8 Critical
- coollabsio coolifyCoolify: File Upload Without Type or Size Validation in Database Backup Restore3.1 Low
- esri arcgis serverUnvalidated File Upload vulnerability in ArcGIS Server.9.8 Critical
- apache iotdbApache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write9.8 Critical
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload5.3 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted upload5.3 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload5.3 Medium
- ruijie rg-uacRuijie RG-UAC user_auth_commit.php unrestricted upload6.9 Medium
- sourcecodester syllabus-aligned learning management and examination systemSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload5.3 Medium
- yonyou ksoaYonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet9.3 Critical
- guangzhou red sea cloud computing co., ltd. red sea cloud ehrRedsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob9.3 Critical
- divi engine form builderDivi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter9.8 Critical
- zozothemes zegenWordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability9.9 Critical
- mycomplianceoffice mco, mycomplianceoffice +1 moreArbitrary File Upload in MCO5.3 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)10.0 Critical
- redeight cmsRemote Code Execution in Redeight CMS8.6 High
- Show moreLoading…