CWE-434: Unrestricted file upload
4,583 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 28 of them as exploited in the wild.
- Published CVEs
- 4,583
- Last 12 months
- 1,042
- Critical
- 1,620
- Known exploited
- 28
Critical 1,620High 1,744Medium 1,173Low 44Not scored 2
CVEs per yearBy the year they were published
- 20152
- 201611
- 201793
- 2018178
- 2019210
- 2020231
- 2021299
- 2022481
- 2023526
- 2024758
- 2025888
- 2026891
Known exploitedNewest addition to KEV first
- CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe · Adobe Commerce
ExploitedCritical9.3 - CVE-2026-56291
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
balbooa.com · balbooa.com Balbooa Forms extension for Joomla
ExploitedCritical10.0 - CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
icagenda.com · iCagenda extension for Joomla
ExploitedCritical10.0 - CVE-2026-56290
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
joomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla
ExploitedCritical10.0 - CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
joomshaper.net · SP Page Builder extension for Joomla
ExploitedCritical10.0 - CVE-2024-7399
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write…
Samsung Electronics · MagicINFO 9 Server
ExploitedHigh8.8 - CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Kentico · Xperience
ExploitedHigh7.2 - CVE-2024-7694
TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload
TeamT5 · ThreatSonar Anti-Ransomware
ExploitedHigh7.2 - CVE-2025-52691
Upload Arbitrary Files
SmarterTools · SmarterMail
ExploitedCritical10.0 - CVE-2018-4063
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP…
Sierra Wireless
ExploitedHigh8.8
Newest CVEs
- CVE-2026-108292
Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026
IBM · Process Mining
Medium5.5 - CVE-2026-123991
DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload
DataEase
Medium6.9 - CVE-2026-17399
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.9 - CVE-2026-104913
Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json
esaia · Interactive Real Estate – Floor Plan & Building Visualizer
High8.8 - CVE-2026-93754
payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
payever · payever Checkout – Composable Payment Gateway
Critical9.8 - CVE-2026-46429
GeoNode: Unrestricted File Upload
GeoNode · geonode
Medium5.5 - CVE-2026-80302
Avast sandbox escape via arbitrary file write in virtualized environment
Gen Digital · Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
Not scored - CVE-2026-92895
Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter
jiangweifang · Live2DWebCanvas
High8.1 - CVE-2026-118423
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
Unknown · WP Libre Form
Critical10.0 - CVE-2026-122047
Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload
Campcodes · Complete Advance Loan Management System
Medium6.9