What MITRE CWE-434 - Unrestricted Upload of File with Dangerous Type requires
CWE-434 (Unrestricted Upload of File with Dangerous Type) is a CWE Top 25 weakness underlying many remote code execution incidents in web applications, including unauthenticated webshell uploads, polyglot file uploads, and SVG-based XSS uploads. CWE-434 is defined as: the product allows the upload or transfer of dangerous file types that are automatically processed within its environment. The Extended Description notes that this vulnerability occurs when applications lack proper validation of uploaded files; attackers can upload executable files (like .php, .asp, .jsp) that web servers automatically process, leading to arbitrary code execution; the danger intensifies when files are stored in web-accessible directories without extension or MIME-type verification. Common Consequences include execute unauthorized code or commands with integrity, confidentiality, and availability scope: arbitrary code execution is possible if an uploaded file is interpreted and executed as code by the recipient; this is especially true for web-server extensions such as .asp and .php because these file types are often treated as automatically executable, even when file system permissions do not specify execution. Potential Mitigations include architecture and design (generate unique filenames instead of using user-supplied names; store uploads outside the web document root and deliver files dynamically; implement strict allowlists of acceptable file extensions); implementation (apply input validation using accept-known-good strategy with strict extension checking; ensure single extensions only - prevent file.php.gif bypass techniques; perform case-insensitive extension validation; validate MIME types without relying exclusively on them); and environment (run code with minimal necessary privileges; execute uploads in sandboxed environments - chroot, AppArmor, SELinux).
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/434.html
SHA-256 integrity: 693784e323fa0fdd0594dd5d7cbbea91fe7c36475975fa61722b7c1dd0d7c3ea
Primary Citations — 10 traced to source
- CWE-434: Unrestricted Upload of File with Dangerous Type - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/434.html
- CWE-434 Definition - the product allows the upload or transfer of dangerous file types that are automatically processed within its environment
+ 8 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access