CWE-434

{
  "affected": [],
  "aliases": [
    "CVE-2023-1744"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-30T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.",
  "id": "GHSA-q4fh-5hgq-7rcc",
  "modified": "2023-04-07T15:30:40Z",
  "published": "2023-03-31T00:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1744"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/xieqiangweb/cve/blob/master/cve/IBOS%20oa%20v4.5.5%20upload.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.224632"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.224632"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-04T19:15:31Z",
    "severity": "CRITICAL"
  },
  "details": "An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.",
  "id": "GHSA-q4h7-9j45-w69m",
  "modified": "2025-08-04T21:30:42Z",
  "published": "2025-08-04T21:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md"
    },
    {
      "type": "WEB",
      "url": "http://shenzhen.com"
    },
    {
      "type": "WEB",
      "url": "http://zkeacms.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-34128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-15T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system\u0026action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname.",
  "id": "GHSA-q4jj-x7h4-55rf",
  "modified": "2022-05-24T19:05:20Z",
  "published": "2022-05-24T19:05:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bettershop/LaikeTui/issues/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-2406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-12T21:15:59Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256503.",
  "id": "GHSA-q4p5-gjmc-cpp2",
  "modified": "2024-03-12T21:31:00Z",
  "published": "2024-03-12T21:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2406"
    },
    {
      "type": "WEB",
      "url": "https://note.zhaoj.in/share/7kZiVRqSuiMx"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.256503"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.256503"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-06T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell.",
  "id": "GHSA-q4p6-fc6x-phmp",
  "modified": "2022-05-13T01:07:04Z",
  "published": "2022-05-13T01:07:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1265"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudfoundry.org/blog/cve-2018-1265"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-26776"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-22T16:15:32Z",
    "severity": "CRITICAL"
  },
  "details": "Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3.",
  "id": "GHSA-q526-hh66-mj99",
  "modified": "2026-04-28T21:35:31Z",
  "published": "2025-02-22T18:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26776"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/chaty-pro/vulnerability/wordpress-chaty-pro-plugin-3-3-3-arbitrary-file-upload-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-05T22:15:56Z",
    "severity": "HIGH"
  },
  "details": "The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the \u0027import_styles\u0027 function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible.",
  "id": "GHSA-q54q-m468-q77v",
  "modified": "2024-02-06T00:30:25Z",
  "published": "2024-02-06T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6635"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/block-options/tags/1.40.3/includes/addons/styles-manager/rest-api/gutenberghub-styles-import-export-controller.php#L100"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3010794/block-options"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-28170"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-20T19:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1.",
  "id": "GHSA-q573-xfg5-jv9w",
  "modified": "2026-04-28T21:33:31Z",
  "published": "2023-12-20T21:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28170"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/theme-demo-import/wordpress-theme-demo-import-plugin-1-1-1-arbitrary-file-upload-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nocodb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.301.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-28T21:41:03Z",
    "nvd_published_at": "2026-01-28T21:16:12Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA **stored Cross-site Scripting (XSS)** vulnerability exists in NocoDB\u2019s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment.\n\nBecause the malicious payload is stored server-side and executed under the application\u2019s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.\n\n---\n\n## Vulnerability Details\n\nNocoDB allows file attachments to be previewed inline based on their MIME type. Due to overly permissive MIME type checks and a lack of content sanitization, SVG files containing executable JavaScript are incorrectly treated as safe image content and rendered directly in the browser.\n\n### Root Cause\n\nThe vulnerability results from a combination of **overly permissive MIME type classification** and **unsafe file serving behavior**.\n\n#### 1. Permissive MIME Type Check\n\nIn `attachmentHelpers.ts`, files are considered previewable if their MIME type contains certain substrings:\n\n```ts\nconst previewableMimeTypes = [\u0027image\u0027, \u0027pdf\u0027, \u0027video\u0027, \u0027audio\u0027];\n\nexport const isPreviewAllowed = (args: { mimetype?: string } = {}) =\u003e {\n  const { mimetype } = args;\n  if (!mimetype) return false;\n  return previewableMimeTypes.some((type) =\u003e mimetype.includes(type));\n};\n```\n\nThis substring-based check (`includes`) causes files with the MIME type `image/svg+xml` to be classified as safe for inline preview. However, SVG is an XML-based format that supports executable JavaScript via `\u003cscript\u003e` elements, event handlers, and external references.\n\nNo additional validation or sanitization is performed on SVG content after this classification.\n\n#### 2. Unsafe Inline File Serving\n\nUploaded attachments are served by the `fileReadv3` endpoint in `attachments.controller.ts` without sanitization or content-type enforcement:\n\n```ts\n@Get(\u0027/dltemp/:param(*)\u0027)\nasync fileReadv3(@Param(\u0027param\u0027) param: string, @Res() res: Response) {\n  // No authentication guard\n\n  // Sets headers from query parameters\n  res.setHeader(\u0027Content-Type\u0027, queryParams.contentType);\n  res.setHeader(\u0027Content-Disposition\u0027, queryParams.contentDisposition);\n\n  // Sends raw file content\n  res.sendFile(file.path);\n}\n```\n\nThe endpoint:\n\n* Preserves the original `Content-Type` (`image/svg+xml`)\n* Uses `Content-Disposition: inline`\n* Sends the raw file contents unmodified\n\nAs a result, browsers render the SVG inline and execute any embedded JavaScript under the NocoDB application\u2019s origin.\n\n---\n\n## Impact\n\nThis is a **stored XSS** vulnerability that can be exploited by authenticated users with permission to upload attachments.\n\nPotential impacts include:\n\n* Account takeover\n* Theft of session cookies or API tokens\n* Unauthorized actions performed on behalf of victims\n* Privilege escalation if higher-privileged users view the malicious attachment\n\n---\n\n## Credit\n\nThis issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter St\u00f6ckli) and @m-y-mo (Man Yue Mo).",
  "id": "GHSA-q5c6-h22r-qpwr",
  "modified": "2026-01-28T21:41:03Z",
  "published": "2026-01-28T21:41:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24769"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nocodb/nocodb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3800"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-09T04:16:05Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-q5gc-m94w-rw4r",
  "modified": "2026-03-09T06:31:14Z",
  "published": "2026-03-09T06:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3800"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Resort-Reservation-System---Unrestricted-Upload.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.349767"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.349767"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.768978"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.768998"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}