CWE-646 · File and Path Handling
Reliance on File Name or Extension of Externally-Supplied File
11CVEs
SortMost likely exploited
11 CVEs with CWE-646 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-34639WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File UploadW3 Eden, Inc. · WordPress Download Manager · CVSS 7.5 · 2021-08-05 | 7.5 | 0.6% | 2021-08-05 |
| CVE-2026-126186Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processingrails · rails · CVSS 8.8 · 2026-11-10 | 8.8 | 0.5% | 2026-11-10 |
| CVE-2024-52052Stream Target Remote Code Execution in Wowza Streaming EngineWowza · Streaming Engine · CVSS 9.4 · 2024-11-21 | 9.4 | 0.5% | 2024-11-21 |
| CVE-2025-1889picklescan - Security scanning bypass via non-standard file extensionsmmaitre314 · picklescan · CVSS 5.3 · 2025-03-03 | 5.3 | 0.4% | 2025-03-03 |
| CVE-2025-58449Maho Vulnerable to Authenticated Remote Code Execution via File UploadMahoCommerce · maho · CVSS 8.7 · 2025-09-08 | 8.7 | 0.3% | 2025-09-08 |
| CVE-2023-0350CVE-2023-0350Akuvox · E11 · CVSS 6.5 · 2023-03-13 | 6.5 | 0.3% | 2023-03-13 |
| CVE-2023-45599A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attac…AiLux · imx6 bundle · CVSS 5.5 · 2024-03-05 | 5.5 | 0.2% | 2024-03-05 |
| CVE-2025-41720Sauter: Arbitrary File UploadSauter · modulo 6 devices modu680-AS · CVSS 4.3 · 2025-10-22 | 4.3 | 0.2% | 2025-10-22 |
| CVE-2024-38432Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied FileMatrix · Tafnit v8 · CVSS 5.5 · 2024-07-30 | 5.5 | 0.2% | 2024-07-30 |
| CVE-2025-30662Zoom Workplace VDI Plugin macOS Universal Installer - Symlink FollowingZoom Communications Inc. · Zoom Workplace VDI Plugin macOS Universal installer · CVSS 6.6 · 2025-11-13 | 6.6 | 0.1% | 2025-11-13 |
| CVE-2026-20172Cisco Enterprise Chat and Email Lite Agent File Upload VulnerabilityCisco · Cisco Enterprise Chat and Email · CVSS 4.3 · 2026-05-06 | 4.3 | 0.1% | 2026-05-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.