CWE-434—Unrestricted Upload of File with Dangerous Type
PUBLISHEDweakness recordMedium
released 2006-07-19 · last modified 2026-04-30
Metadata
- CWE ID：
- CWE-434
- 摘要：
- Base
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-07-19
- 更新日期：
- 2026-04-30
名称
Unrestricted Upload of File with Dangerous Type
描述
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
常见后果
- 范围：
- Integrity, Confidentiality, Availability
- 影响：
- Execute Unauthorized Code or Commands
- 注释：
- Arbitrary code execution is possible if an uploaded file is interpreted and executed as code by the recipient. This is especially true for web-server extensions such as .asp and .php because these file types are often treated as automatically executable, even when file system permissions do not specify execution. For example, in Unix environments, programs typically cannot run unless the execute bit is set, but PHP programs may be executed by the web server without directly invoking them on the operating system.
