CWE-434: Unrestricted Upload of File with Dangerous Type

Detection Methods

Method

Dynamic Analysis with Automated Results Interpretation

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners

Method

Dynamic Analysis with Manual Results Interpretation

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer

Method

Manual Static Analysis - Source Code

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)

Effectiveness

High

Method

Automated Static Analysis - Source Code

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

Effectiveness

High

Method

Architecture or Design Review

Description

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

Effectiveness

High

Code Examples & CVEs

Demonstrative Examples

The following code intends to allow a user to upload a picture to the web server. The HTML code that drives the form on the user end has an input field of type "file".

Once submitted, the form above sends the file to upload_picture.php on the web server. PHP stores the file in a temporary location until it is retrieved (or discarded) by the server side code. In this example, the file is moved to a more permanent pictures/ directory.

GoodHTML

<form action="upload_picture.php" method="post" enctype="multipart/form-data">                      Choose a file to upload:<input type="file" name="filename"/><br/><input type="submit" name="submit" value="Submit"/>                      </form>

The following code intends to allow a user to upload a picture to the web server. The HTML code that drives the form on the user end has an input field of type "file".

BadPHP

// Define the target location where the picture being                                                                  // uploaded is going to be saved.                      $target = "pictures/" . basename($_FILES['uploadedfile']['name']);                                            // Move the uploaded file to the new location.                      if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target)){echo "The picture has been successfully uploaded.";}else{echo "There was an error uploading the picture, please try again.";}

The following code intends to allow a user to upload a picture to the web server. The HTML code that drives the form on the user end has an input field of type "file".

AttackPHP

<?phpsystem($_GET['cmd']);                      ?>

The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.

When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.

GoodHTML

<form action="FileUploadServlet" method="post" enctype="multipart/form-data">                      Choose a file to upload:<input type="file" name="filename"/><br/><input type="submit" name="submit" value="Submit"/>                      </form>

BadJava

public class FileUploadServlet extends HttpServlet {                                               ...                            protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {                                                           response.setContentType("text/html");PrintWriter out = response.getWriter();String contentType = request.getContentType();                                  // the starting position of the boundary headerint ind = contentType.indexOf("boundary=");String boundary = contentType.substring(ind+9);                                  String pLine = new String();String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value                                  // verify that content type is multipart form dataif (contentType != null && contentType.indexOf("multipart/form-data") != -1) {                                                                       // extract the filename from the Http headerBufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));...pLine = br.readLine();String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));...                                        // output the file to the local upload directorytry {                                           BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));for (String line; (line=br.readLine())!=null; ) {if (line.indexOf(boundary) == -1) {bw.write(line);bw.newLine();bw.flush();}} //end of for loopbw.close();                                                                                                                        } catch (IOException ex) {...}// output successful upload response HTML page                                  }// output unsuccessful upload response HTML pageelse{...}                            }...                                               }

Observed CVE Examples (11)

CVE-2023-5227

PHP-based FAQ management app does not check the MIME type for uploaded images

View Details

CVE-2001-0901

Web-based mail product stores ".shtml" attachments that could contain SSI

View Details

CVE-2002-1841

PHP upload does not restrict file types

View Details

CVE-2005-1868

upload and execution of .php file

View Details

CVE-2005-1881

upload file with dangerous extension

View Details

CVE-2005-0254

program does not restrict file types

View Details

CVE-2004-2262

improper type checking of uploaded files

View Details

CVE-2006-4558

Double "php" extension leaves an active php extension in the generated filename.

View Details

CVE-2006-6994

ASP program allows upload of .asp files by bypassing client-side checks

ASP file upload

ASP file upload

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-434 trust boundary

MITRE identifies dynamic analysis, manual source review, architecture or design review as applicable detection approaches. Use them to follow uploaded bytes from request parsing through validation, renaming, transformation, storage, retrieval, and any interpreter or web-server execution path. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-434: detection methods and operational guidance — MITRE CWE

Treat file upload validation as layered containment

Allow only the extensions required by the business function, decode the filename before validating it, and do not trust the client-supplied Content-Type header. Generate storage names, enforce size limits, require authorization, and keep uploads outside the web root or on a separate host. Where appropriate, scan or sandbox content and protect the upload action against CSRF.

File Upload Cheat Sheet — OWASP Foundation

Apply lessons from CVE-2024-7694 in TeamT5 ThreatSonar Anti-Ransomware

NVD maps CVE-2024-7694 to CWE-434; uploaded file content was not validated sufficiently, allowing a remote administrator to place malicious files and execute system commands on the server. Use the case to test privileged upload features as code-execution boundaries, inspect file content rather than headers alone, and prevent uploaded content from entering executable locations.

CVE-2024-7694 Detail — NIST National Vulnerability Database

Prioritize CWE-434 using its 2025 CWE Top 25 evidence

CWE-434 ranked #12 in the 2025 CWE Top 25 with a score of 6.87. The ranking table recorded 4 mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Attempt executable, polyglot, and parser-confusing uploads

Test extension allowlists against case changes, multiple extensions, encoded names, alternate data streams where relevant, mismatched Content-Type, magic-byte spoofing, polyglots, archives, and files that exploit downstream processors. Verify server-generated names, size limits, authorization, malware or content scanning, and storage outside executable web paths, then retrieve each accepted file to confirm safe response headers.

Test Upload of Unexpected File Types — OWASP Foundation

Frequently Asked Questions

What is CWE-434: Unrestricted Upload of File with Dangerous Type?+

CWE-434: Unrestricted Upload of File with Dangerous Type is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Is CWE-434 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-434 ranked #6 in the CWE Top 25 for 2024, associated with 322 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of Unrestricted Upload of File with Dangerous Type?+

If exploited, CWE-434 (Unrestricted Upload of File with Dangerous Type) it can compromise Integrity, Confidentiality and Availability, leading to outcomes such as Execute Unauthorized Code or Commands.

How do you prevent or mitigate Unrestricted Upload of File with Dangerous Type?+

Recommended mitigations for CWE-434 include: Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423] Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423] Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.

How is Unrestricted Upload of File with Dangerous Type detected?+

CWE-434 can be detected using Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code, Automated Static Analysis - Source Code and Architecture or Design Review. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Unrestricted Upload of File with Dangerous Type?+

CWE-434 commonly affects ASP.NET, PHP and Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Unrestricted Upload of File with Dangerous Type?+

MITRE documents real CVEs mapped to CWE-434, including CVE-2023-5227, CVE-2001-0901, CVE-2002-1841, CVE-2005-1868 and CVE-2005-1881. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-434 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-434: Unrestricted Upload of File with Dangerous Type

Technical Details

Applicable To

🏆 CWE Top 25 Historical Ranking

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Phase

Description

Phase

Description

Strategy

Phase

Description

Phase

Description

Phase

Description

Detection Methods

Method

Description

Method

Description

Method

Description

Effectiveness

Method

Description

Effectiveness

Method

Description

Effectiveness

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (11)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine review and analysis around the CWE-434 trust boundary

Treat file upload validation as layered containment

Apply lessons from CVE-2024-7694 in TeamT5 ThreatSonar Anti-Ransomware

Prioritize CWE-434 using its 2025 CWE Top 25 evidence

Attempt executable, polyglot, and parser-confusing uploads

Frequently Asked Questions

Learn More