CWE-434 · File and Path Handling
Unrestricted File Upload
4,345CVEs
26exploited
115with a public check
257likely (EPSS 10%+)
SortMost likely exploited
4,345 CVEs with CWE-434 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-12617In CISA KEVExploitedApache Tomcat - Remote Code ExecutionApache Software Foundation · Apache Tomcat · CVSS 8.1 · 2017-10-03 | 8.1 | 100% | 2017-10-03 |
| CVE-2018-15961In CISA KEVExploitedAdobe ColdFusion - Unrestricted File Upload Remote Code ExecutionAdobe · ColdFusion · CVSS 9.8 · 2018-09-25 | 9.8 | 100% | 2018-09-25 |
| CVE-2021-31207In CISA KEVExploitedMicrosoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 23 · CVSS 6.6 · 2021-05-11 | 6.6 | 100% | 2021-05-11 |
| CVE-2017-12615In CISA KEVExploitedApache Tomcat Servers - Remote Code ExecutionApache Software Foundation · Apache Tomcat · CVSS 8.1 · 2017-09-19 | 8.1 | 100% | 2017-09-19 |
| CVE-2025-31324In CISA KEVExploitedSAP NetWeaver Visual Composer Metadata Uploader - DeserializationSAP_SE · SAP NetWeaver (Visual Composer development server) · CVSS 10 · 2025-04-24 | 10.0 | 99% | 2025-04-24 |
| CVE-2024-50623In CISA KEVExploitedCleo Harmony < 5.8.0.21 - Arbitary File ReadCleo · Multiple Products · CVSS 9.8 · 2024-10-27 | 9.8 | 99% | 2024-10-27 |
| CVE-2016-3088In CISA KEVExploitedApache ActiveMQ Fileserver - Arbitrary File WriteApache · ActiveMQ · CVSS 9.8 · 2016-06-01 | 9.8 | 98% | 2016-06-01 |
| CVE-2020-25213In CISA KEVExploitedWordPress File Manager Plugin - Remote Code ExecutionWordPress · File Manager Plugin · CVSS 10 · 2020-09-09 | 10.0 | 97% | 2020-09-09 |
| CVE-2020-8260In CISA KEVExploitedA vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extrac…Ivanti · Pulse Connect Secure / Pulse Policy Secure · CVSS 7.2 · 2020-10-28 | 7.2 | 96% | 2020-10-28 |
| CVE-2026-48908In CISA KEVExploitedJoomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCEjoomshaper.net · SP Page Builder extension for Joomla · CVSS 10 · 2026-06-20 | 10.0 | 89% | 2026-06-20 |
| CVE-2025-52691In CISA KEVExploitedSmarterMail - Unrestricted File UploadSmarterTools · SmarterMail · CVSS 10 · 2025-12-29 | 10.0 | 86% | 2025-12-29 |
| CVE-2017-11357In CISA KEVExploitedProgress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or…Telerik · User Interface (UI) for ASP.NET AJAX · CVSS 9.8 · 2017-08-23 | 9.8 | 78% | 2017-08-23 |
| CVE-2019-8394In CISA KEVExploitedZoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.Zoho · ManageEngine · CVSS 7.5 · 2019-02-17 | 7.5 | 63% | 2019-02-17 |
| CVE-2026-48356In CISA KEVExploitedAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe · Adobe Commerce · CVSS 9.3 · 2026-07-14 | 9.3 | 47% | 2026-07-14 |
| CVE-2021-27860In CISA KEVExploitedArbitrary file upload vulnerability in FatPipe softwareFatPipe · WARP · CVSS 9.8 · 2021-12-08 | 9.8 | 40% | 2021-12-08 |
| CVE-2021-26828In CISA KEVExploitedOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.OpenPLC · ScadaBR · CVSS 8.8 · 2021-06-11 | 8.8 | 39% | 2021-06-11 |
| CVE-2020-13671In CISA KEVExploitedDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type…Drupal · Drupal Core · CVSS 8.8 · 2020-11-20 | 8.8 | 33% | 2020-11-20 |
| CVE-2024-57968In CISA KEVExploitedAdvantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). u…Advantive · VeraCore · CVSS 9.9 · 2025-02-03 | 9.9 | 32% | 2025-02-03 |
| CVE-2026-56290In CISA KEVExploitedPage Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Uploadjoomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla · CVSS 10 · 2026-06-29 | 10.0 | 31% | 2026-06-29 |
| CVE-2018-4063In CISA KEVExploitedAn exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a…Sierra Wireless · Sierra Wireless · CVSS 8.8 · 2019-05-06 | 8.8 | 27% | 2019-05-06 |
| CVE-2026-48939In CISA KEVExploitedJoomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCEicagenda.com · iCagenda extension for Joomla · CVSS 10 · 2026-06-20 | 10.0 | 20% | 2026-06-20 |
| CVE-2021-20022In CISA KEVExploitedSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.SonicWall · Email Security · CVSS 7.2 · 2021-04-09 | 7.2 | 17% | 2021-04-09 |
| CVE-2026-56291In CISA KEVExploitedBalbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Uploadbalbooa.com · balbooa.com Balbooa Forms extension for Joomla · CVSS 10 · 2026-07-09 | 10.0 | 15% | 2026-07-09 |
| CVE-2021-36741In CISA KEVExploitedAn improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upl…Trend Micro · Trend Micro Apex One · CVSS 8.8 · 2021-07-29 | 8.8 | 5.0% | 2021-07-29 |
| CVE-2024-39717In CISA KEVExploitedThe Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or…Versa · Director · CVSS 6.6 · 2024-08-22 | 6.6 | 4.0% | 2024-08-22 |
| CVE-2024-7694In CISA KEVExploitedTeamT5 ThreatSonar Anti-Ransomware - Arbitrary File UploadTeamT5 · ThreatSonar Anti-Ransomware · CVSS 7.2 · 2024-08-12 | 7.2 | 1.8% | 2024-08-12 |
| CVE-2021-3378CheckFortiLogger 4.4.2.2 - Arbitrary File UploadFortilogger · Fortilogger · 2021-02-01 | – | 98% | 2021-02-01 |
| CVE-2018-9206CheckBlueimp jQuery-File-Upload v9.22.0 - Unrestricted File UploadBlueimp · Blueimp jQuery-File-Upload · 2018-10-11 | – | 97% | 2018-10-11 |
| CVE-2017-6090CheckPhpColl 2.5.1 Arbitrary File UploadPhpcollab · Phpcollab · 2017-10-02 | – | 96% | 2017-10-02 |
| CVE-2020-24186CheckWordPress wpDiscuz <=7.0.4 - Remote Code ExecutionGvectors · Wpdiscuz · CVSS 10 · 2020-08-24 | 10.0 | 95% | 2020-08-24 |
| CVE-2024-8856CheckWP Time Capsule Plugin - Remote Code Executionrevmakx · Backup and Staging by WP Time Capsule · CVSS 9.8 · 2024-11-16 | 9.8 | 94% | 2024-11-16 |
| CVE-2014-8739CheckWordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File UploadCreative-Solutions · Creative Contact Form · 2020-02-08 | – | 92% | 2020-02-08 |
| CVE-2023-20073CheckCisco VPN Routers - Unauthenticated Arbitrary File UploadCisco · Cisco Small Business RV Series Router Firmware · CVSS 5.3 · 2023-04-05 | 5.3 | 90% | 2023-04-05 |
| CVE-2021-24145CheckWordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File UploadWebnus · Modern Events Calendar Lite · 2021-03-18 | – | 88% | 2021-03-18 |
| CVE-2023-5360CheckWordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File UploadRoyal-Elementor-Addons · Royal Elementor Addons and Templates · 2023-10-31 | – | 86% | 2023-10-31 |
| CVE-2020-28871CheckMonitorr 1.7.6m - Unauthenticated Remote Code ExecutionMonitorr · Monitorr · 2021-02-10 | – | 86% | 2021-02-10 |
| CVE-2021-24155CheckWordPress BackupGuard <1.6.0 - Authenticated Arbitrary File UploadBackup-Guard · WordPress Backup and Migrate Plugin – Backup Guard · 2021-04-05 | – | 84% | 2021-04-05 |
| CVE-2021-21351CheckXStream <1.4.16 - Remote Code Executionx-stream · xstream · CVSS 5.4 · 2021-03-22 | 5.4 | 82% | 2021-03-22 |
| CVE-2020-12800CheckWordPress Contact Form 7 <1.3.3.3 - Remote Code ExecutionCodedropz · Drag And Drop Multiple File Upload - Contact Form 7 · 2020-06-08 | – | 79% | 2020-06-08 |
| CVE-2023-4220CheckChamilo LMS <= 1.11.24 - Remote Code ExecutionChamilo · Chamilo · CVSS 8.1 · 2023-11-28 | 8.1 | 76% | 2023-11-28 |
| CVE-2023-3836CheckDahua Smart Park Management - Arbitrary File UploadDahua · Smart Park Management · CVSS 6.3 · 2023-07-22 | 6.3 | 76% | 2023-07-22 |
| CVE-2018-20526CheckRoxy Fileman 1.4.5 - Unrestricted File UploadRoxyfileman · Roxy Fileman · 2019-03-18 | – | 73% | 2019-03-18 |
| CVE-2024-0352CheckLikeshop < 2.5.7.20210311 - Arbitrary File UploadLikeshop · Likeshop · CVSS 7.3 · 2024-01-09 | 7.3 | 73% | 2024-01-09 |
| CVE-2025-34299CheckMonsta FTP <= 2.11.2 - Unauthenticated Remote Code ExecutionMonsta Limited of New Zealand · Monsta FTP · CVSS 9.3 · 2025-11-07 | 9.3 | 73% | 2025-11-07 |
| CVE-2020-29597CheckIncomCMS 2.0 - Arbitrary File UploadIncomcms Project · Incomcms · 2020-12-07 | – | 71% | 2020-12-07 |
| CVE-2023-51409CheckJordy Meow AI Engine - Unrestricted File UploadJordy Meow · AI Engine: ChatGPT Chatbot · CVSS 10 · 2024-04-12 | 10.0 | 63% | 2024-04-12 |
| CVE-2026-0740CheckNinja Forms File Uploads <= 3.3.26 - Arbitrary File UploadSaturdayDrive · Ninja Forms - File Uploads · CVSS 9.8 · 2026-04-07 | 9.8 | 63% | 2026-04-07 |
| CVE-2023-27179CheckGDidees CMS v3.9.1 - Arbitrary File DownloadGdidees · Gdidees Cms · CVSS 7.5 · 2023-04-11 | 7.5 | 61% | 2023-04-11 |
| CVE-2021-30118CheckKaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code ExecutionKaseya · Vsa · CVSS 9.8 · 2021-07-09 | 9.8 | 60% | 2021-07-09 |
| CVE-2021-24499CheckWordPress Workreap - Remote Code ExecutionAmentotech · Workreap · 2021-08-09 | – | 60% | 2021-08-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.