baserCMS versions prior to 5.2.3 contain a vulnerability in the restore function that allows uploading and automatic extraction of . zip files without proper validation. A malicious PHP file inside the archive can be included via require_once, leading to arbitrary code execution. This vulnerability has been patched in version 5.2.3.
Sharp, a Laravel content management framework package, has a vulnerability in versions prior to 9.20.0 that allows authenticated users to bypass file type restrictions on uploads. The issue arises because the file upload endpoint accepts a client-controlled validation_rule parameter, which is passed directly to the Laravel validator without proper server-side checks. This enables attackers to bypass MIME type and file extension restrictions by manipulating the validation_rule parameter. The vulnerability is addressed in version 9.20.0 by removing client control over validation rules and enforcing strict server-side upload rules. A workaround is to ensure the storage disk for uploads is private, as default configurations prevent direct execution of uploaded PHP files unless a public disk is used.
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.
CVE-2026-23636 is a medium severity vulnerability in Kiteworks Secure Data Forms prior to version 9.2.1. It involves an unrestricted upload of files with dangerous types due to missing validation, which could be exploited by a form manager. This vulnerability can lead to integrity impact but does not affect confidentiality. A patch is available in Kiteworks version 9.2.1 and later.
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
CVE-2025-60947 is a high-severity vulnerability in Census CSWeb version 8.0.1 that allows authenticated remote attackers to upload arbitrary files without proper restrictions. This unrestricted file upload flaw (CWE-434) can lead to remote code execution, compromising confidentiality, integrity, and availability of affected systems. The vulnerability requires authentication but no user interaction beyond that. It has a CVSS score of 8.8, indicating a critical impact if exploited. The issue is fixed in version 8.1.0 alpha.
CVE-2026-33717 is a high-severity vulnerability in WWBN AVideo versions up to 26.0 that allows attackers to upload and persistently store executable PHP files in a web-accessible directory. This occurs because the downloadVideoFromDownloadURL() function saves remote content using the original filename and extension without proper validation, and an attacker can trigger an early termination that prevents cleanup of the malicious file. Exploiting this flaw can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. No user interaction is required, but low privilege authentication is needed. A patch has been committed to address this issue. Organizations running vulnerable versions should urgently update to mitigate risk. Countries with significant AVideo deployments and strategic interest in video platforms are most at risk.
CVE-2026-33647 is a high-severity vulnerability in WWBN AVideo versions up to 26.0 that allows remote code execution via unrestricted upload of a file with a dangerous extension. The vulnerability arises because the application validates uploaded file content using MIME type detection but does not enforce an allowlist on the file extension derived from the user-supplied filename. Attackers can upload a crafted polyglot file containing valid JPEG headers followed by embedded PHP code with a . php extension. Since the MIME check passes, the file is saved as an executable PHP script in a web-accessible directory, enabling execution of arbitrary code on the server. No user interaction is required beyond file upload, and the exploit requires low privileges. A patch addressing this issue has been committed. Organizations running vulnerable versions should apply the patch immediately and implement stricter file extension validation to prevent exploitation.
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations, leading to arbitrary code execution in the context of the web server.
CVE-2026-33071 is a medium severity vulnerability in FileRise versions prior to 3.8.0, a self-hosted web file manager and WebDAV server. The vulnerability arises because the WebDAV upload endpoint does not validate file extensions, allowing attackers to upload files with dangerous server-side executable extensions such as . php, . phtml, and . htaccess. This bypasses the filename validation enforced on the regular upload path. In deployments without Apache's LocationMatch protection, this can lead to remote code execution. The flaw is due to the createFile() and put() methods accepting filenames directly from WebDAV clients without validation.
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.
This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`qweasd123456`) and ignores file content. A background watcher (`StartWatcher`) then scans this folder every 5 seconds. If it finds a new executable, it runs it immediately, resulting in RCE. Version 4.0.0 fixes the issue.
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.
The Pix for WooCommerce WordPress plugin (versions up to and including 1.5.0) contains an unrestricted file upload vulnerability due to missing capability checks and file type validation. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability is identified as CWE-434 and has a CVSS 3.1 score of 9.8, indicating critical severity.
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.