CWE-646: Reliance on File Name or Extension of Externally-Supplied File
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- openwebui open webui, open-webui +1 more Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions 8.7 High
- cisco enterprise chat and email Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability 4.3 Medium
- zoom communications inc. workplace vdi plugin macos universal installer, zoom workplace virtual desktop infrastructure +1 more Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following 6.6 Medium
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 more Sauter: Arbitrary File Upload 4.3 Medium
- mahocommerce maho Maho Vulnerable to Authenticated Remote Code Execution via File Upload 8.7 High
- mmaitre314 picklescan picklescan - Security scanning bypass via non-standard file extensions 5.3 Medium
- mmaitre314 picklescan picklescan - Security scanning bypass via 'pip main' 5.3 Medium
- wowza streaming engine Stream Target Remote Code Execution in Wowza Streaming Engine 9.4 Critical
- spip SPIP Bigup Multipart File Upload OS Command Injection 9.8 Critical
- matrix tafnit v8, matrix-globalservices tafnit +1 more Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File 5.5 Medium
- ailux imx6, imx6 bundle +1 more A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the ... 5.5 Medium
- akuvox e11, e11 firmware +1 more CVE-2023-0350 6.5 Medium
- w3 eden, inc. wordpress download manager, w3eden download manager +1 more WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload 7.5 High