CWE-646

11 published CVEs are weaknesses of this kind, as the records or NVD name it.

Newest CVEs

CVE-2026-126186
Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
rails · rails
High8.8
CVE-2026-45315
Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
open-webui · open-webui
High8.7
CVE-2026-20172
Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
Cisco · Cisco Enterprise Chat and Email
Medium4.3
CVE-2025-30662
Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following
Zoom Communications Inc. · Zoom Workplace VDI Plugin macOS Universal installer
Medium6.6
CVE-2025-41720
Sauter: Arbitrary File Upload
Sauter · modulo 6 devices modu680-AS
Medium4.3
CVE-2025-58449
Maho Vulnerable to Authenticated Remote Code Execution via File Upload
MahoCommerce · maho
High8.7
CVE-2025-1889
picklescan - Security scanning bypass via non-standard file extensions
mmaitre314 · picklescan
Medium5.3
CVE-2024-52052
Stream Target Remote Code Execution in Wowza Streaming Engine
Wowza · Streaming Engine
Critical9.4
CVE-2024-38432
Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
Matrix · Tafnit v8
Medium5.5
CVE-2023-45599
A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote…
AiLux · imx6 bundle
Medium5.5