Home/CWE/Unrestricted Upload of File with Dangerous Type
Weakness

Unrestricted Upload of File with Dangerous Type

CWE-434 · Base · Draft

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-669 · Incorrect Resource Transfer Between Spheres
Related
PeerOfCWE-351 · Insufficient Type Distinction
PeerOfCWE-430 · Deployment of Wrong Handler
PeerOfCWE-436 · Interpretation Conflict
◆

Attack Patterns (CAPEC)

1
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-1Accessing Functionality Not Properly Constrained by ACLs
⚠

CVEs With This Weakness

4,888
A sample of the 4,888 CVEs tagged with this weakness.
CVECVE-2026-8758
CVECVE-2026-7733
CVECVE-2026-7732
CVECVE-2026-7711
CVECVE-2026-7696
CVECVE-2026-7673
CVECVE-2026-7578
CVECVE-2026-7490
CVECVE-2026-7393
CVECVE-2026-7238
CVECVE-2026-7134
CVECVE-2026-7133
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalDrupal 7 Elfinder - Remote Code Execution
criticalMeterSphere - Remote Code Execution
criticalMagento PolyShell - Unauthenticated File Upload to RCE
criticalCore Chuangtian Cloud Desktop System - Remote Code Execution
criticalOA E-Office jQuery - Arbitrary File Upload
criticalWeaver E-Cology KtreeUploadAction - Arbitrary File Upload
criticalOA E-Office LazyUploadify - Arbitrary File Upload
criticalWeaver OA Workrelate - Arbitary File Upload
criticalEcology - Arbitrary File Upload
criticalSecGate 3600 Firewall obj_app_upfile - Arbitrary File Upload
criticalWordPress AIT CSV Import Export - Unauthenticated Remote Code Execution
criticalWordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload
criticalPrestashop Blocktestimonial Modules - File Upload Vulnerability
criticalPrestashop Cart Abandonment Pro File Upload
criticalApache Flink - Remote Code Execution
criticalRuijie NBR fileupload.php - Arbitrary File Upload
criticalUFIDA U8-CRM getemaildata - Arbitary File Upload
criticalTongda OA v2017 action_upload - Arbitrary File Upload
criticalBlueImp jQuery-File-Upload - Arbitrary File Upload
criticalShowdoc <2.8.6 - File Uploads
criticalPan Micro E-office File Uploads
criticalMonsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution
criticalSangfor OSM - Arbitrary File Upload
criticalMelis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
criticalJEHC-BPM - Remote Code Execute
criticalWordPress Simple File List <=4.2.2 - Remote Code Execution
criticalSAP NetWeaver Visual Composer Metadata Uploader - Deserialization
criticalLearnPress Plugin < 4.2.0 - Local File Inclusion
criticalWooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
criticalWBCE CMS v1.5.4 - Remote Code Execution
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin