CWE-4341 advisories

Unrestricted File Upload

What it is

The app accepts uploads without checking type/content, letting an attacker upload an executable payload.

How to fix it

Upgrade and validate type, extension and content; store outside the web root.

How to avoid it

Allow-list content types, rename files, and never serve uploads from an executable path.

Known Unrestricted File Upload vulnerabilities

CVE-2017-12615 — critical · Web app/Unrestricted File Upload

Stateward flags Unrestricted File Upload in your own code and dependencies on every pull request.

Scan my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.