CWE-434: Unrestricted file upload
4,571 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 28 of them as exploited in the wild.
- Published CVEs
- 4,571
- Last 12 months
- 1,054
- Critical
- 1,616
- Known exploited
- 28
Critical 1,616High 1,742Medium 1,168Low 44Not scored 1
CVEs per yearBy the year they were published
- 20252
- 2026726
- 2026806
- 2026763
- 2026544
- 2026444
- 2026347
- 2026309
- 202635
- 202620
- 202622
- 202610
Known exploitedNewest addition to KEV first
- CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe · Adobe Commerce
ExploitedCritical9.3 - CVE-2026-56291
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
balbooa.com · balbooa.com Balbooa Forms extension for Joomla
ExploitedCritical10.0 - CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
icagenda.com · iCagenda extension for Joomla
ExploitedCritical10.0 - CVE-2026-56290
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
joomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla
ExploitedCritical10.0 - CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
joomshaper.net · SP Page Builder extension for Joomla
ExploitedCritical10.0 - CVE-2024-7399
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write…
Samsung Electronics · MagicINFO 9 Server
ExploitedHigh8.8 - CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Kentico · Xperience
ExploitedHigh7.2 - CVE-2024-7694
TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload
TeamT5 · ThreatSonar Anti-Ransomware
ExploitedHigh7.2 - CVE-2025-52691
Upload Arbitrary Files
SmarterTools · SmarterMail
ExploitedCritical10.0 - CVE-2018-4063
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP…
Sierra Wireless
ExploitedHigh8.8
Newest CVEs
- CVE-2026-121733
Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
Webkul · Bagisto
Low2.1 - CVE-2026-73328
Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
volmarg · personal-management-system
High8.6 - CVE-2026-76124
BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint
BuddyBoss · BuddyBoss App
High8.8 - CVE-2026-120534
Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
ACF Extended · Advanced Custom Fields: Extended PRO
Critical9.8 - CVE-2026-105606
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
joomlaboat.com · Custom Tables extension for Joomla
Critical9.5 - CVE-2026-105603
Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3
dj-extensions.com · DJ-Classifieds extension for Joomla
Critical9.4 - CVE-2026-76010
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
High8.8 - CVE-2026-118235
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
wpazleen · SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Critical9.8 - CVE-2026-116512
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
wedevs · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
Critical9.8 - CVE-2026-119620
37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload
37954679 · cak-filemanagement-system
Medium6.9