CWE-434: Unrestricted File Upload
The product allows the upload of files with dangerous types that can be automatically processed within the product environment.
Yearly Trend
Top Affected Vendors
All Unrestricted File Upload CVEs (1,428)
CVE-2023-51412 is an unauthenticated arbitrary file upload vulnerability in the Piotnet Forms WordPress plugin. Attackers can upload malicious files w...
Dec 29, 2023This vulnerability allows unauthenticated attackers to upload arbitrary files to WordPress sites using the User Submitted Posts plugin. Attackers can ...
Dec 20, 2023HCL Compass has an unrestricted file upload vulnerability that allows attackers to upload malicious files containing executable code. This could lead ...
Oct 18, 2023This vulnerability allows attackers to upload malicious SVG files containing JavaScript to the Organizr web application, which then executes in users'...
Apr 13, 2022This vulnerability allows authenticated low-privileged users in Chamilo LMS to upload malicious files and execute arbitrary code on the server. The sy...
Mar 6, 2026This vulnerability allows authenticated users to upload .htaccess or .user.ini files to FreeScout help desk systems, enabling remote code execution on...
Feb 25, 2026CVE-2018-25158 is an arbitrary file upload vulnerability in Chamilo LMS that allows authenticated users to upload PHP files disguised as images, then ...
Feb 20, 2026OpenSourcePOS 3.4.1 contains a Local File Inclusion vulnerability that allows attackers to read arbitrary files on the web server by manipulating invo...
Feb 20, 2026CVE-2025-13689 is an unrestricted file upload vulnerability in IBM DataStage on Cloud Pak for Data that allows authenticated users to upload malicious...
Feb 17, 2026This vulnerability allows authorized users to upload executable files through CIPPlanner CIPAce's rich text editor and document management components....
Feb 11, 2026Agentflow software by Flowring contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files and execu...
Feb 10, 2026This vulnerability allows attackers to upload malicious files (like web shells) to Sensaway web servers without proper file type validation. It affect...
Feb 9, 2026Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin that allows attackers to upload malicious files to web-...
Feb 5, 2026This vulnerability allows authenticated administrators in jizhiCMS 1.6.7 to download arbitrary files from the server by exploiting the admin plugins u...
Feb 5, 2026This vulnerability in n8n's Merge node allows authenticated users with workflow creation/modification permissions to write arbitrary files to the serv...
Feb 4, 2026This vulnerability in Cisco Meeting Management allows authenticated attackers with video operator privileges to upload malicious files through the web...
Feb 4, 2026The WP FOFT Loader WordPress plugin has a vulnerability that allows authenticated attackers with Author-level access or higher to upload arbitrary fil...
Feb 4, 2026This CVE describes an arbitrary file upload vulnerability in FPDF's AddFont() function that allows attackers to upload malicious PHP files. Successful...
Feb 3, 2026The OS DataHub Maps WordPress plugin has an arbitrary file upload vulnerability that allows authenticated attackers with Author-level access or higher...
Feb 3, 2026An unauthenticated attacker can upload arbitrary files to MagicInfo9 Server, leading to remote code execution and privilege escalation. This affects M...
Feb 2, 2026CVE-2021-47904 is an authenticated file upload vulnerability in PhreeBooks 5.2.3 that allows attackers to upload malicious PHP files through the Image...
Jan 23, 2026CVE-2021-47888 is an authenticated remote code execution vulnerability in Textpattern CMS that allows logged-in users to upload malicious PHP files an...
Jan 23, 2026IBM Concert versions 1.0.0 through 2.1.0 contain an unrestricted file upload vulnerability that allows attackers to upload malicious files to the web ...
Jan 20, 2026This vulnerability in Easy Discuss for Joomla allows attackers to upload malicious files by bypassing extension-based validation. Attackers can upload...
Jan 16, 2026This vulnerability allows authenticated attackers with author-level WordPress access to upload malicious files disguised as VTT subtitle files, bypass...
Jan 16, 2026A file upload vulnerability in Omnispace Agora Project allows authenticated users (and sometimes guest users) to upload arbitrary files via the Upload...
Jan 15, 2026CVE-2021-47757 is an authenticated remote code execution vulnerability in Chikitsa Patient Management System 2.0.2. Authenticated attackers can upload...
Jan 15, 2026CVE-2021-47758 allows authenticated attackers to upload malicious PHP plugins through Chikitsa Patient Management System's module upload functionality...
Jan 15, 2026The Supreme Modules Lite WordPress plugin has an arbitrary file upload vulnerability in versions up to 2.5.62. Authenticated attackers with author-lev...
Jan 15, 2026This vulnerability allows authenticated attackers to execute arbitrary PHP code on WBCE CMS servers by uploading malicious droplets through the admin ...
Jan 13, 2026This vulnerability allows remote attackers to execute arbitrary code on Automai Director v25.2.0 systems by exploiting the update mechanism. Attackers...
Jan 12, 2026The WP Enable WebP WordPress plugin has a vulnerability that allows authenticated attackers with Author-level permissions or higher to upload arbitrar...
Jan 7, 2026CVE-2025-15240 is an arbitrary file upload vulnerability in QOCA aim AI Medical Cloud Platform that allows authenticated attackers to upload malicious...
Jan 5, 2026CVE-2025-55061 is an unrestricted file upload vulnerability (CWE-434) that allows attackers to upload malicious files to vulnerable systems. This coul...
Dec 29, 2025This vulnerability allows attackers to upload malicious files to Specto CM systems, potentially leading to remote code execution. It affects all Spect...
Dec 24, 2025WebTareas 2.4 contains an authenticated file upload vulnerability that allows attackers to upload malicious PHP files and execute arbitrary code on th...
Dec 22, 2025Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, allowing attackers to upload malicious files to the server. This can lead to remo...
Dec 18, 2025File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives. Attackers ca...
Dec 18, 2025CVE-2023-53933 is a remote code execution vulnerability in Serendipity 2.4.0 that allows authenticated attackers to upload malicious PHP files with .p...
Dec 17, 2025This vulnerability allows authenticated attackers to upload malicious PHP files disguised as avatar images in UliCMS, leading to remote code execution...
Dec 17, 2025CVE-2023-53868 is a remote code execution vulnerability in Coppermine Gallery that allows authenticated attackers to upload malicious PHP files throug...
Dec 15, 2025FNT Command 13.4.0 contains a vulnerability in its C Base Module that allows remote code execution. Attackers can upload malicious files to execute ar...
Dec 15, 2025The WP3D Model Import Viewer plugin for WordPress has a vulnerability that allows authenticated attackers with Author-level access or higher to upload...
Dec 13, 2025The Infility Global WordPress plugin allows authenticated attackers with subscriber-level access or higher to upload arbitrary files due to missing fi...
Dec 12, 2025This vulnerability allows authenticated administrators in WBCE CMS to upload malicious ZIP modules containing PHP reverse shell code, leading to remot...
Dec 11, 2025This vulnerability allows authenticated attackers to upload malicious PHP files through the Elfinder file manager in WBCE CMS version 1.6.2, leading t...
Dec 10, 2025appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through...
Dec 10, 2025Dotclear 2.29 contains an authenticated remote code execution vulnerability where attackers with valid credentials can upload malicious PHP files thro...
Dec 10, 2025This CSRF vulnerability in the Video Merchant WordPress plugin allows unauthenticated attackers to upload arbitrary files by tricking administrators i...
Dec 10, 2025LeptonCMS 7.3.0 contains an arbitrary file upload vulnerability due to insufficient file validation. Authenticated attackers can upload malicious ZIP/...
Dec 9, 2025About Unrestricted File Upload (CWE-434)
The product allows the upload of files with dangerous types that can be automatically processed within the product environment.
Our database tracks 1,428 CVEs classified as CWE-434, with 704 rated critical and 609 rated high severity. The average CVSS score for Unrestricted File Upload vulnerabilities is 8.8.
External reference: View CWE-434 on MITRE CWE →
Monitor Unrestricted File Upload Vulnerabilities
Get alerted when new Unrestricted File Upload CVEs affect your infrastructure.
Start Monitoring Free