CWE-351

15 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 1High 6Medium 6Low 2Not scored 0

CVEs per yearBy the year they were published

CVE-2023-38831
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because…
Product not named
ExploitedHigh7.8

CVE-2026-15305
TYPO3 CMS - Unrestricted File Upload in Form Framework
TYPO3 · TYPO3 CMS
Medium6.3
CVE-2025-31951
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability
HCL · BigFix RunBookAI
High8.8
CVE-2026-41341
OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension
OpenClaw · OpenClaw
Low2.3
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
contao · contao
Medium6.6
CVE-2025-54413
skops' MethodNode can access unexpected object fields through dot notation, leading to arbitrary code execution at load time
skops-dev · skops
High8.7
CVE-2025-54412
skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Execution
skops-dev · skops
High8.7
CVE-2025-47939
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
TYPO3 · typo3
Medium5.4
CVE-2025-30510
Growatt Cloud portal Insufficient Type Distinction
Growatt · Cloud portal
Critical9.3
CVE-2025-32035
DNN does not check the contents of a file when uploading files
dnnsoftware · Dnn.Platform
Low2.6
CVE-2024-45676
IBM Cognos Controller file upload
IBM · Cognos Controller
Medium4.3