CWE · MITRE source
CWE-434Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (4)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-44 | Detonation Chambers | SC | Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs. |
SC-51 | Hardware-based Protection | SC | Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures. |
MP-7 | Media Use | MP | Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media. |
SI-3 | Malicious Code Protection | SI | Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-25213 KEV | 9.7 | 10.0 | 0.9442 | 2020-09-09 |
CVE-2016-3088 KEV | 9.6 | 9.8 | 0.9423 | 2016-06-01 |
CVE-2017-11357 KEV | 9.6 | 9.8 | 0.9368 | 2017-08-23 |
CVE-2018-15961 KEV | 9.6 | 9.8 | 0.9442 | 2018-09-25 |
CVE-2024-50623 KEV | 9.6 | 9.8 | 0.9401 | 2024-10-28 |
CVE-2017-12615 KEV | 9.3 | 8.1 | 0.9420 | 2017-09-19 |
CVE-2017-12617 KEV | 9.3 | 8.1 | 0.9436 | 2017-10-04 |
CVE-2025-52691 KEV | 9.2 | 10.0 | 0.8640 | 2025-12-29 |
CVE-2021-31207 KEV | 9.0 | 6.6 | 0.9384 | 2021-05-11 |
CVE-2019-8394 KEV | 8.6 | 6.5 | 0.8752 | 2019-02-17 |
CVE-2021-26828 KEV | 8.6 | 8.8 | 0.8002 | 2021-06-11 |
CVE-2024-7399 KEV | 8.6 | 8.8 | 0.8130 | 2024-08-12 |
CVE-2020-8260 KEV | 8.0 | 7.2 | 0.7589 | 2020-10-28 |
CVE-2020-24186 | 7.7 | 10.0 | 0.9421 | 2020-08-24 |
CVE-2018-9206 | 7.6 | 9.8 | 0.9365 | 2018-10-11 |
CVE-2020-12800 | 7.6 | 9.8 | 0.9388 | 2020-06-08 |
CVE-2020-28871 | 7.6 | 9.8 | 0.9392 | 2021-02-10 |
CVE-2021-24499 | 7.6 | 9.8 | 0.9394 | 2021-08-09 |
CVE-2023-5360 | 7.6 | 9.8 | 0.9348 | 2023-10-31 |
CVE-2023-51409 | 7.6 | 10.0 | 0.9291 | 2024-04-12 |
CVE-2024-5084 | 7.6 | 9.8 | 0.9323 | 2024-05-23 |
CVE-2014-8739 | 7.5 | 9.8 | 0.9155 | 2020-02-08 |
CVE-2021-3378 | 7.5 | 9.8 | 0.9285 | 2021-02-01 |
CVE-2021-36356 | 7.5 | 9.8 | 0.9300 | 2021-08-31 |
CVE-2021-25003 | 7.5 | 9.8 | 0.9158 | 2022-03-14 |