Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-434 (危险类型文件的不加限制上传) — Vulnerability Class 2032

2032 vulnerabilities classified as CWE-434 (危险类型文件的不加限制上传). AI Chinese analysis included.

CWE-434 represents a critical input validation weakness where applications permit the upload of file types that are inherently dangerous or automatically processed by the system. Attackers typically exploit this vulnerability by uploading malicious scripts, such as web shells or executable binaries, disguised as legitimate documents or images. Once uploaded, these files are executed by the server, granting the attacker remote code execution capabilities and potentially full system compromise. To mitigate this risk, developers must implement strict allowlists that define only the specific, safe file extensions permitted for upload. Additionally, files should be stored outside the web root directory to prevent direct execution, and content verification techniques, such as checking file headers rather than relying solely on extensions, should be employed to ensure integrity and prevent evasion of basic validation checks.

MITRE CWE Description
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Common Consequences (1)
Integrity, Confidentiality, AvailabilityExecute Unauthorized Code or Commands
Arbitrary code execution is possible if an uploaded file is interpreted and executed as code by the recipient. This is especially true for web-server extensions such as .asp and .php because these file types are often treated as automatically executable, even when file system permissions do not spec…
Mitigations (5)
Architecture and DesignGenerate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
Architecture and DesignWhen the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Architecture and DesignConsider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and DesignDefine a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
Examples (2)
The following code intends to allow a user to upload a picture to the web server. The HTML code that drives the form on the user end has an input field of type "file".
<form action="upload_picture.php" method="post" enctype="multipart/form-data"> Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> </form>
Good · HTML
// Define the target location where the picture being // uploaded is going to be saved. $target = "pictures/" . basename($_FILES['uploadedfile']['name']); // Move the uploaded file to the new location. if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target)) { echo "The picture has been successfully uploaded."; } else { echo "There was an error uploading the picture, please try again."; }
Bad · PHP
The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
<form action="FileUploadServlet" method="post" enctype="multipart/form-data"> Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> </form>
Good · HTML
public class FileUploadServlet extends HttpServlet { ... protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html"); PrintWriter out = response.getWriter(); String contentType = request.getContentType(); // the starting position of the boundary header int ind = contentType.indexOf("boundary="); String boundary = contentType.substring(ind+9); String pLine = new String(); String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value // verify that content type is multipart form data i
Bad · Java
CVE IDTitleCVSSSeverityPublished
CVE-2026-41517 Emlog: Remote Code Execution via Malicious Plugin Upload — emlog--2026-05-08
CVE-2026-6692 Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url — Slider Revolution 8.8 High2026-05-07
CVE-2026-41587 CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution — ci4ms--2026-05-07
CVE-2026-41938 Vvveb < 1.0.8.2 RCE via Media Upload Handler — Vvveb 8.8 High2026-05-06
CVE-2026-6261 Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload — Betheme 8.8 High2026-05-05
CVE-2026-7733 funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload — funadmin 7.3 High2026-05-04
CVE-2026-7732 code-projects BloodBank Managing System request_blood.php unrestricted upload — BloodBank Managing System 6.3 Medium2026-05-04
CVE-2026-7711 MindsDB Engine proc_wrapper.py exec unrestricted upload — MindsDB 7.3 High2026-05-03
CVE-2026-7696 Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload — EEMS Enterprise Power Operation and Maintenance Cloud Platform 6.3 Medium2026-05-03
CVE-2026-7673 crmeb_java Admin Upload UploadServiceImpl.java unrestricted upload — crmeb_java 4.7 Medium2026-05-03
CVE-2026-7490 Sunnet|CTMS and CPAS - Arbitrary File Upload — CTMS 7.2 High2026-05-02
CVE-2026-4882 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload — User Registration Advanced Fields 9.8 Critical2026-05-02
CVE-2026-7578 MacCMS Pro Plugin Installation add.html install unrestricted upload — MacCMS Pro 4.7 Medium2026-05-01
CVE-2022-50993 Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet — E-office 9.8 Critical2026-04-30
CVE-2026-7393 SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload — Pizzafy Ecommerce System 4.7 Medium2026-04-29
CVE-2026-7238 code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload — Online Music Site 4.7 Medium2026-04-28
CVE-2026-7134 code-projects Online Lot Reservation System edithousepic.php unrestricted upload — Online Lot Reservation System 4.7 Medium2026-04-27
CVE-2026-7133 code-projects Online Lot Reservation System activity.php unrestricted upload — Online Lot Reservation System 4.7 Medium2026-04-27
CVE-2026-7107 code-projects Invoice System in Laravel company unrestricted upload — Invoice System in Laravel 6.3 Medium2026-04-27
CVE-2026-7044 GreenCMS index.php themeadd unrestricted upload — GreenCMS 6.3 Medium2026-04-26
CVE-2026-7043 GreenCMS index.php pluginAddLocal unrestricted upload — GreenCMS 6.3 Medium2026-04-26
CVE-2026-5364 Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass — Drag and Drop File Upload for Contact Form 7 8.1 High2026-04-24
CVE-2026-41269 Flowise: File Upload Validation Bypass in createAttachment — Flowise 7.1 High2026-04-23
CVE-2026-6885 BorG Technology Corporation|Borg SPM 2007 - Arbitrary File Upload — Borg SPM 2007 9.8 Critical2026-04-23
CVE-2026-3844 Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote — Breeze Cache 9.8 Critical2026-04-23
CVE-2025-36074 Security vulnerability has been detected in IBM Security Verify Directory — Security Verify Directory (Container) 5.5 Medium2026-04-22
CVE-2026-6835 aEnrich|a+HCM - Arbitrary File Upload — a+HCM 6.1 Medium2026-04-22
CVE-2019-25714 Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet — A8-V5 Collaborative Management Software 9.8AICriticalAI2026-04-21
CVE-2026-6249 Vvveb CMS < 1.0.8.2 Remote Code Execution via Media Upload — Vvveb CMS 8.8 High2026-04-20
CVE-2026-6257 Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management — Vvveb CMS 9.1 Critical2026-04-20

Vulnerabilities classified as CWE-434 (危险类型文件的不加限制上传) represent 2032 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.