# Unrestricted file upload. Uploads of dangerous file types, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [Multiple Vulnerabilities in IBM API Connect](https://agentprime.io/advisories/CVE-2026-17399.md) `CVE-2026-17399` · CVE record: IBM API Connect · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2026 · Tags: Unrestricted file upload - [Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json](https://agentprime.io/advisories/CVE-2026-104913.md) `CVE-2026-104913` · CVE record: esaia Interactive Real Estate – Floor Plan & Building Visualizer · CVSS 8.8 High · Not analysed yet · Published 7 Nov 2026 · Tags: Unrestricted file upload - [payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-93754.md) `CVE-2026-93754` · CVE record: payever payever Checkout – Composable Payment Gateway · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2026 · Tags: Unrestricted file upload - [GeoNode has Unrestricted File Upload](https://agentprime.io/advisories/GHSA-fqpv-mq26-pr4j.md) `GHSA-fqpv-mq26-pr4j`, `CVE-2026-46429` · PyPI `geonode`: affected `<5.0.3`, fixed in `5.0.3` · CVSS 5.5 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Unrestricted file upload - [Avast sandbox escape via arbitrary file write in virtualized environment](https://agentprime.io/advisories/CVE-2026-80302.md) `CVE-2026-80302` · CVE record: Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate and 2 more · No CVSS score · Not analysed yet · Published 6 Nov 2026 · Tags: Unrestricted file upload, CWE-653 - [Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter](https://agentprime.io/advisories/CVE-2026-92895.md) `CVE-2026-92895` · CVE record: jiangweifang Live2DWebCanvas · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2026 · Tags: Unrestricted file upload - [WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-118423.md) `CVE-2026-118423` · CVE record: Unknown WP Libre Form · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2026 · Tags: Unrestricted file upload - [Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-122047.md) `CVE-2026-122047` · CVE record: Campcodes Complete Advance Loan Management System · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, Unrestricted file upload - [Unrestricted file upload in Yealink Plug-in Softwares](https://agentprime.io/advisories/CVE-2026-122120.md) `CVE-2026-122120` · CVE record: Yealink Plug-in Softwares · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Unrestricted file upload - [WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files](https://agentprime.io/advisories/CVE-2026-115243.md) `CVE-2026-115243` · CVE record: Unknown WPvivid — Backup, Migration & Staging · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Unrestricted file upload - [Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload](https://agentprime.io/advisories/CVE-2026-121733.md) `CVE-2026-121733` · CVE record: Webkul Bagisto · CVSS 2.1 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Unrestricted file upload - [Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/](https://agentprime.io/advisories/CVE-2026-73328.md) `CVE-2026-73328` · CVE record: volmarg personal-management-system · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Unrestricted file upload - [BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint](https://agentprime.io/advisories/CVE-2026-76124.md) `CVE-2026-76124` · CVE record: BuddyBoss BuddyBoss App · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Unrestricted file upload - [Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type](https://agentprime.io/advisories/CVE-2026-120534.md) `CVE-2026-120534` · CVE record: ACF Extended Advanced Custom Fields: Extended PRO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Unrestricted file upload - [Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8](https://agentprime.io/advisories/CVE-2026-105606.md) `CVE-2026-105606` · CVE record: joomlaboat.com Custom Tables extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Unrestricted file upload - [Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3](https://agentprime.io/advisories/CVE-2026-105603.md) `CVE-2026-105603` · CVE record: dj-extensions.com DJ-Classifieds extension for Joomla · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Unrestricted file upload - [Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal](https://agentprime.io/advisories/CVE-2026-76010.md) `CVE-2026-76010` · CVE record: smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · CVSS 8.8 High · Not analysed yet · Published 31 Oct 2026 · Tags: Unrestricted file upload - [SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data](https://agentprime.io/advisories/CVE-2026-118235.md) `CVE-2026-118235` · CVE record: wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Unrestricted file upload - [Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection](https://agentprime.io/advisories/CVE-2026-116512.md) `CVE-2026-116512` · CVE record: wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Unrestricted file upload - [37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-119620.md) `CVE-2026-119620` · CVE record: 37954679 cak-filemanagement-system · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload](https://agentprime.io/advisories/CVE-2026-76012.md) `CVE-2026-76012` · CVE record: smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Unrestricted file upload - [Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field](https://agentprime.io/advisories/CVE-2026-115346.md) `CVE-2026-115346` · CVE record: ThemeFusion Avada | Website Builder For WordPress & WooCommerce · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Unrestricted file upload - [SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)](https://agentprime.io/advisories/CVE-2026-61738.md) `CVE-2026-61738` · CVE record: socfortress CoPilot · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Unrestricted file upload - [Arbitrary File Upload in Protectel](https://agentprime.io/advisories/CVE-2025-68391.md) `CVE-2025-68391` · CVE record: ARKETEAM PROTECTELMAJ and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Unrestricted file upload - [Docat has Arbitrary File Upload exists in Upload API](https://agentprime.io/advisories/CVE-2026-61645.md) `CVE-2026-61645` · CVE record: docat-org docat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Unrestricted file upload - [Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist](https://agentprime.io/advisories/GHSA-r899-h629-j84r.md) `GHSA-r899-h629-j84r`, `BIT-parse-2026-61448`, `CVE-2026-61448` · npm `parse-server`: affected `<8.6.84 || >=9.0.0, <9.10.0-alpha.2`, fixed in `8.6.84`, `9.10.0-alpha.2` · CVSS 2.1 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Unrestricted file upload - [Virtual Folder Path Confinement Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90866.md) `CVE-2026-90866` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, Unrestricted file upload - [Host Administrator Path Containment Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90864.md) `CVE-2026-90864` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, Unrestricted file upload - [Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-115245.md) `CVE-2026-115245` · CVE record: Unknown Chat AI with Dispatcher · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Unrestricted file upload - [Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin](https://agentprime.io/advisories/CVE-2026-16889.md) `CVE-2026-16889` · CVE record: Apereo Foundation openEQUELLA · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Unrestricted file upload - [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67073.md) `CVE-2026-67073` · CVE record: HCL Software BigFix AEX · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), Broken access control, Unrestricted file upload, Information disclosure - [Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass](https://agentprime.io/advisories/CVE-2026-109218.md) `CVE-2026-109218` · CVE record: kleor Contact Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload](https://agentprime.io/advisories/CVE-2026-109384.md) `CVE-2026-109384` · CVE record: melograno The Innovative Form Builder – IvyForms · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-103688.md) `CVE-2026-103688` · CVE record: Unknown Checkout Files Upload for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter](https://agentprime.io/advisories/CVE-2026-111255.md) `CVE-2026-111255` · CVE record: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler](https://agentprime.io/advisories/CVE-2026-84999.md) `CVE-2026-84999` · CVE record: Pie Register Pie Register Premium · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import](https://agentprime.io/advisories/CVE-2026-117607.md) `CVE-2026-117607` · CVE record: thexerteproject xerteonlinetoolkits · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields](https://agentprime.io/advisories/CVE-2014-125138.md) `CVE-2014-125138` · CVE record: C97net qEngine CMS and 2 more · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload - [oretnom23 php-travel-agency-system employee_insert.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-117512.md) `CVE-2026-117512` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [Unrestricted Upload of File in PuMuKIT application](https://agentprime.io/advisories/CVE-2026-4337.md) `CVE-2026-4337` · CVE record: PuMuKIT PuMuKIT · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Unrestricted file upload - [SourceCodester Online Food Ordering System add_food.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-116603.md) `CVE-2026-116603` · CVE record: SourceCodester Online Food Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.](https://agentprime.io/advisories/CVE-2026-115188.md) `CVE-2026-115188` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Code injection, Unrestricted file upload - [Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload](https://agentprime.io/advisories/CVE-2026-116236.md) `CVE-2026-116236` · CVE record: Oray Pugongying X5 Pro · CVSS 8.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [GouGuOA Api.php chunkUpload unrestricted upload](https://agentprime.io/advisories/CVE-2026-116113.md) `CVE-2026-116113` · CVE record: GouGuOA · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-116057.md) `CVE-2026-116057` · CVE record: KodCloud KodExplorer · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-116044.md) `CVE-2026-116044` · CVE record: prasathmani TinyFileManager · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload](https://agentprime.io/advisories/CVE-2026-115481.md) `CVE-2026-115481` · CVE record: baserproject basercms · CVSS 8.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Unrestricted file upload - [Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload](https://agentprime.io/advisories/CVE-2026-113472.md) `CVE-2026-113472` · CVE record: Unknown Depicter — Popup & Slider Builder · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Unrestricted file upload - [Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer](https://agentprime.io/advisories/CVE-2026-59188.md) `CVE-2026-59188` · CVE record: Part-DB Part-DB-server · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload - [Part-DB: Authenticated RCE via .phar attachment upload served from public/media](https://agentprime.io/advisories/CVE-2026-54630.md) `CVE-2026-54630` · CVE record: Part-DB Part-DB-server · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Unrestricted file upload - [Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52](https://agentprime.io/advisories/CVE-2026-102785.md) `CVE-2026-102785` · CVE record: yootheme.com YOOtheme Pro extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Unrestricted file upload - [file-management-system FileController.php store unrestricted upload](https://agentprime.io/advisories/CVE-2026-114262.md) `CVE-2026-114262` · CVE record: file-management-system · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [oretnom23 file-management-system-php admin_class.php save_files unrestricted upload](https://agentprime.io/advisories/CVE-2026-114259.md) `CVE-2026-114259` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-111832.md) `CVE-2026-111832` · CVE record: WP Mailster WP Mailster · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Unrestricted file upload - [WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-111834.md) `CVE-2026-111834` · CVE record: Kitae Park Mang Board WP · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Unrestricted file upload - [Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo](https://agentprime.io/advisories/CVE-2026-114398.md) `CVE-2026-114398` · CVE record: polonel trudesk · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Unrestricted file upload - [IBM Cyber Fraud includes components with multiple known vulnerabilities](https://agentprime.io/advisories/CVE-2026-87800.md) `CVE-2026-87800` · CVE record: IBM Cyber Fraud · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Unrestricted file upload - [DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload](https://agentprime.io/advisories/CVE-2026-113393.md) `CVE-2026-113393` · CVE record: DrayTek Vigor2960 · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload](https://agentprime.io/advisories/CVE-2026-113382.md) `CVE-2026-113382` · CVE record: arizu-id fast-tunnel · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-107188.md) `CVE-2026-107188` · CVE record: Eptura Archibus · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Unrestricted file upload Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .