CWE-434: Unrestricted Upload of File with Dangerous Type, page 2
Filter
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
What the weakness is: CWE-434 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-434, as MITRE names them. Credits.
Ask an AI about CWE-434
Show the prompt
Explain CWE-434: Unrestricted Upload of File with Dangerous Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/434.html and https://cve.bz/cve/cwe/434?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2026-111311EPSS 0.5%
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_…
- 8.8CVE-2026-92553EPSS 0.6%
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validati…
- 9.8CVE-2026-103768EPSS 0.6%
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation…
- 9.8CVE-2026-109219EPSS 0.7%
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-de…
- 9.1CVE-2026-105032EPSS 0.9%
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use pa…
- 9.8CVE-2026-108587EPSS 0.9%
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing …
- 6.5CVE-2026-57491EPSS 0.3%
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes…
- 8.8CVE-2026-86461EPSS 0.7%
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the che…
- 9.8CVE-2026-87855EPSS 0.8%
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth p…
- 9.8CVE-2026-104800EPSS 1.0%
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verifi…
- 9.8CVE-2026-110002EPSS 0.9%
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and n…
- 9.8CVE-2026-93388EPSS 0.9%
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJ…
- 10.0CVE-2026-105899EPSS 1.0%
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary …
- 9.1CVE-2026-54454EPSS 0.4%
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for o…
- 6.9CVE-2026-110025EPSS 0.4%
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_…
- 5.5CVE-2026-108975EPSS 0.3%
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unr…
- 5.5CVE-2026-108974EPSS 0.3%
A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launc…
- 5.5CVE-2026-108973EPSS 0.3%
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted uplo…
- 5.3CVE-2026-89271EPSS 0.2%
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary l…
- 2.1CVE-2026-108922EPSS 0.3%
A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/imag…
- 8.6CVE-2026-109397EPSS 0.4%
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the ra…
- 8.8CVE-2026-103535EPSS 1.1%
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does n…
- 5.4CVE-2026-103529EPSS 0.3%
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method wh…
- 7.2CVE-2026-103522EPSS 0.6%
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass…
- 7.2CVE-2026-103521EPSS 0.6%
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this …
- 2.1CVE-2026-108801EPSS 0.3%
A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestrict…
- 4.3CVE-2026-93550EPSS 0.2%
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level ac…
- 9.8CVE-2026-104028EPSS 0.6%
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers …
- 9.9CVE-2026-62129EPSS 0.3%
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
- 9.0CVE-2026-62025EPSS 0.3%
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
- 9.9CVE-2026-62024EPSS 0.4%
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
- 8.8CVE-2026-83526EPSS 0.6%
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes att…
- 7.2CVE-2026-104752EPSS 0.5%
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code exe…
- 9.8CVE-2026-103889EPSS 1.0%
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce c…
- 9.8CVE-2026-94589EPSS 0.7%
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to mis…
- 8.7CVE-2026-108113EPSS 0.6%
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool i…
- 7.7CVE-2026-108101EPSS 0.5%
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload…
- 10.0CVE-2026-94503EPSS 0.4%
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
- 8.8CVE-2025-15700EPSS 0.4%
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's managem…
- 7.3CVE-2026-91844EPSS 0.2%
Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6.
- 9.8CVE-2026-85097ExploitEPSS 3.3%
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads…
- 9.1CVE-2026-17609EPSS 0.3%
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-co…
- 8.8CVE-2026-17196EPSS 0.5%
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the …
- 7.5CVE-2026-92532EPSS 0.3%
Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web inte…
- 8.6CVE-2026-105868EPSS 0.2%
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute…
- 8.7CVE-2026-105862EPSS 0.3%
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitizat…
- 8.6CVE-2026-104069EPSS 0.5%
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is p…
- 10.0CVE-2026-39770EPSS 0.4%
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
- 9.9CVE-2026-39759EPSS 0.4%
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
- 9.9CVE-2026-39757EPSS 0.4%
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.