Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
114 results · page 1 of 3
Oct 13, 2026Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instCVE-2026-109162 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.3
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().CVE-2026-88392 · Other software · reported by MITREHigh 7.5
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Flask-Reuploaded provides file uploads for Flask.CVE-2026-54567 · Other software · jugmac00 · reported by GitHubHigh 7.5
Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server's privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0.
- Product
- flask-reuploaded
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages().CVE-2026-86749 · Other software · grokability · reported by VulnCheckHigh 7
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where a failed Storage::delete() still nulled the model's image field, orphaning the file on disk. The condition is not directly attacker-controlled: it is triggered when any legitimate authenticated user submits an image upload while the storage backend transiently fails (for example an S3 network error, a local filesystem permission problem, or quota exhaustion). The result is unrecoverable loss of the prior image and a durable inconsistency between the database and disk that requires manual reconciliation. All models whose controllers route through ImageUploadRequest::handleImages (assets, asset models, users, comp
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 31, 2026Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload.CVE-2026-71257 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by another component, Commons FileUpload returns no items and Wicket falls back to reading the upload through HttpServletRequest#getParts(). The per-file size limit (for example Form#setFileMaxSize) and the file count limit (Form#setFileCountMax) are not applied to the parts obtained that way, and no exception is raised, so the upload is processed as though those limits had been satisfied. A remote uploader can therefore submit files that are larger, or more numerous, than the application permits, up to whatever the component that parsed the request allows. A part carrying no Content-Type header is additionally read into memory in full during parsing, so the size of that allocation is determined by the request and bounded only by those same external limits. The total upload size limit (Form#setMaxSize) is not affected. Commons FileUpload compares the declared Content-Length against it before reading the body, so a request declaring an oversized length is rejected before the fallback is reached.
- Product
- Apache Wicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 24, 2026Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP fiCVE-2026-56702 · Other software · vrana · reported by VulnCheckHigh 7.1
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
- Product
- adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 14, 2026Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured.CVE-2026-15305 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.3
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackersCVE-2022-50973 · Other software · Yonyou Network Technology Co., Ltd. · reported by VulnCheckCritical 9.3
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).
- Product
- KSOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability.CVE-2026-9772 · Other software · Unraid · reported by zdi-disclosures@trendmicro.comHigh 8.8
Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30116.
- Product
- Unraid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026CarrierWave is a framework to upload files from Ruby applications.CVE-2026-44587 · Other software · carrierwaveuploader · reported by GitHubMedium 4.7
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored
- Product
- carrierwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-systeCVE-2026-41363 · Other software · OpenClaw · reported by VulnCheckMedium 6
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Feb 24, 2026Flask-Reuploaded provides file uploads for Flask.CVE-2026-27641 · Other software · jugmac00 · reported by GitHubCritical 9.8
Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the `name` parameter, use auto-generated filenames only, and implement strict input validation if `name` must be used.
- Product
- flask-reuploaded
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php.CVE-2023-7330 · Other software · Beijing Star-Net Ruijie Network Technology Co., Ltd. · reported by VulnCheckCritical 9.3
Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of file type, path, or extension. A remote attacker can upload a crafted PHP file and then access it from the web root, resulting in arbitrary code execution in the context of the web service. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-14 UTC.
- Product
- NBR Series Routers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files.CVE-2025-27224 · Other software · Rocketsoftware · reported by MITRECritical 9.8
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to write to any filename with any file type at any location on the local server, ultimately allowing execution of arbitrary code.
- Product
- Trufusion Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrcesecurity.com
Sep 30, 2025Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.CVE-2025-56520 · Other software · Dify · reported by MITREMedium 5.3
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. A different vulnerability than CVE-2025-29720.
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability.CVE-2025-6799 · Other software · Marvell · reported by zdi-disclosures@trendmicro.comHigh 7.5
Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the getFileUploadBytes method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24919.
- Product
- QConvergeConsole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability.CVE-2025-6797 · Other software · Marvell · reported by zdi-disclosures@trendmicro.comHigh 7.5
Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the getFileUploadBytes method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24917.
- Product
- QConvergeConsole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability.CVE-2025-6795 · Other software · Marvell · reported by zdi-disclosures@trendmicro.comHigh 7.5
Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the getFileUploadSize method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24914.
- Product
- QConvergeConsole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function.CVE-2025-50405 · Other software · Intelbras · reported by MITREMedium 6.5
Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comintelbras.com
Jun 16, 2025Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.CVE-2025-48976 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
- Product
- Apache Commons FileUpload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 14, 2025Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.CVE-2025-29720 · Other software · Langgenius · reported by MITREMedium 4.8
Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pCVE-2024-57082 · Other software · reported by MITREMedium 6.5
A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a craftedCVE-2024-51053 · Other software · avscms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- avscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinqqer.comvulners.com
Jun 25, 2024An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitraryCVE-2024-35527 · Other software · farcry · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file.
- Product
- farcry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbastionsecurity.co.nzbastionsecurity.co.nz
May 23, 2024An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via CVE-2024-35570 · Other software · inxedu · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.
- Product
- inxedu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024NETGEAR ProSAFE Network Management System MFileUploadController Unrestricted File Upload Remote Code Execution Vulnerability.CVE-2023-38095 · Network & remote access · NETGEAR · reported by zdi-disclosures@trendmicro.comHigh 8.8
NETGEAR ProSAFE Network Management System MFileUploadController Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the MFileUploadController class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19717.
- Product
- ProSAFE Network Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comzerodayinitiative.com
Apr 30, 2024An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php compCVE-2024-33270 · Websites & servers · prestashop · reported by MITREHigh 7.5
An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php component.
- Product
- prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Mar 24, 2024CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks.CVE-2024-29034 · Other software · carrierwaveuploader · reported by GitHubMedium 6.8
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.
- Product
- carrierwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.phCVE-2023-6282 · Other software · IceHrm · reported by cve-coordination@incibe.esMedium 5.4
IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially hijacking the victim's browser.
- Product
- IceHrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload fuCVE-2023-6723 · Other software · Repox · reported by cve-coordination@incibe.esCritical 10
An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload function, due to the lack of proper file type validation controls, resulting in a full system compromise.
- Product
- Repox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function,CVE-2023-6721 · Other software · Repox · reported by cve-coordination@incibe.esHigh 8.3
An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system.
- Product
- Repox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks.CVE-2023-49090 · Other software · carrierwaveuploader · reported by GitHubMedium 6.8
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.
- Product
- carrierwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to byCVE-2023-3545 · Other software · Chamilo · reported by info@starlabs.sgCritical 9.8
Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component.CVE-2023-4760 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.6
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.
- Product
- Eclipse RAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Sep 7, 2023A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web sCVE-2023-39424 · Other software · Resort Data Processing, Inc. · reported by cve-requests@bitdefender.comCritical 9.9
A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but can be paired with another vulnerability in the platform (CVE-2023-39420, which grants access to hardcoded credentials) to carry the attack without having assigned credentials.
- Product
- IRM Next Generation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Aug 14, 2023PrivateUploader is an open source image hosting server written in Vue and TypeScript.CVE-2023-40020 · Other software · PrivateUploader · reported by GitHubCritical 9.9
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PrivateUploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploCVE-2023-34944 · Other software · Chamilo · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2023When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: CVE-2023-33251 · Other software · Lightbend · reported by MITREMedium 4.7
When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946.
- Product
- Akka Http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2023Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists.CVE-2021-33990 · Other software · liferay · reported by MITRECritical 9.8
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.
- Product
- portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 10, 2023Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introducCVE-2023-27901 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introducCVE-2023-27900 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2023Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS witCVE-2023-24998 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
- Product
- Apache Commons FileUpload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jan 27, 2023Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader.CVE-2022-39812 · Other software · Italtel · reported by MITREHigh 7.5
Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request (not possible using the GUI) to an arbitrary directory. Because the application does not check in which directory a file will be uploaded, an attacker can perform a variety of attacks that can result in unauthorized access to the server.
- Product
- Netmatch-s CI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jan 27, 2023Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader.CVE-2022-39811 · Other software · Italtel · reported by MITRECritical 9.1
Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
- Product
- Netmatch-s CI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jun 15, 2022In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy.CVE-2022-20146 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-211757677References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 12, 2022An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files iCVE-2022-27261 · Other software · Express-fileupload Project · reported by MITREHigh 7.5
An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.
- Product
- Express-fileupload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-27140 · Other software · Express-fileupload Project · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload middleware is not responsible for an application's business logic (e.g., determining whether or how a file should be renamed).
- Product
- Express-fileupload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously craftCVE-2021-44664 · Other software · Xerte · reported by MITREHigh 8.8
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
- Product
- Xerte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 22, 2021This affects all versions of package pekeupload.CVE-2021-23673 · Other software · Pekeupload Project · reported by report@snyk.ioMedium 5.4
This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.
- Product
- Pekeupload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file.CVE-2020-19303 · Other software · Houdunren · reported by MITREHigh 7.8
An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file.
- Product
- Hdcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.