# Unrestricted file upload.

Uploads of dangerous file types, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [H3C CVM Unauthenticated File Upload via fileUpload/upload Token](https://agentprime.io/advisories/CVE-2023-54405.md)
  `CVE-2023-54405` · CVE record: H3C CVM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Unrestricted file upload
- [onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload](https://agentprime.io/advisories/CVE-2026-104637.md)
  `CVE-2026-104637` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import](https://agentprime.io/advisories/CVE-2026-104471.md)
  `CVE-2026-104471` · CVE record: YesWiki yeswiki · CVSS 8.6 High · Not analysed yet · Published 2 Oct 2026 · Tags: Unrestricted file upload
- [Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-92820.md)
  `CVE-2026-92820` · CVE record: SaturdayDrive Ninja Forms - File Uploads · CVSS 8.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Unrestricted file upload
- [GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction](https://agentprime.io/advisories/CVE-2026-56660.md)
  `CVE-2026-56660` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF), Unrestricted file upload, Server-side request forgery (SSRF)
- [Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager](https://agentprime.io/advisories/CVE-2026-64949.md)
  `CVE-2026-64949` · CVE record: Pandora FMS Pandora FMS · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Unrestricted file upload
- [CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager](https://agentprime.io/advisories/CVE-2026-64947.md)
  `CVE-2026-64947` · CVE record: Pandora FMS Pandora FMS · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF), Unrestricted file upload
- [formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload](https://agentprime.io/advisories/CVE-2026-103541.md)
  `CVE-2026-103541` · CVE record: formtools.org Form Tools · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Genians, Inc Genian SSL PNS Unrestricted File Upload](https://agentprime.io/advisories/CVE-2026-76144.md)
  `CVE-2026-76144` · CVE record: Genians, Inc Genian SSL PNS (frodo-core) and 1 more · CVSS 1.8 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Unrestricted file upload
- [Kiteworks Email Protection Gateway Remote Code Execution](https://agentprime.io/advisories/CVE-2026-102130.md)
  `CVE-2026-102130` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, Unrestricted file upload
- [Kiteworks Core Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2026-102137.md)
  `CVE-2026-102137` · CVE record: Kiteworks Core · CVSS 4.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2026-102143.md)
  `CVE-2026-102143` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass, Unrestricted file upload
- [yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE](https://agentprime.io/advisories/CVE-2026-103474.md)
  `CVE-2026-103474` · CVE record: yii2-starter-kit yii2-starter-kit · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16](https://agentprime.io/advisories/CVE-2026-102427.md)
  `CVE-2026-102427` · CVE record: ordasoft.com OrdaSoft Joomla CCK · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [DigiWin｜EasyFlow .NET - Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-102454.md)
  `CVE-2026-102454` · CVE record: DigiWin EasyFlow .NET · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-75873.md)
  `CVE-2026-75873` · CVE record: Unknown Zella Theme · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload](https://agentprime.io/advisories/CVE-2026-102842.md)
  `CVE-2026-102842` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2026-70356.md)
  `CVE-2026-70356` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Unrestricted file upload
- [Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2026-96431.md)
  `CVE-2026-96431` · CVE record: Flowring Technology Corp Agentflow 4.0 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Unrestricted file upload
- [mwasikz robo-cafe-rms manage-food.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-102263.md)
  `CVE-2026-102263` · CVE record: mwasikz robo-cafe-rms · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints](https://agentprime.io/advisories/CVE-2026-102366.md)
  `CVE-2026-102366` · CVE record: gz-yami mall4j · CVSS 2.1 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Unrestricted file upload
- [FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module](https://agentprime.io/advisories/CVE-2026-54675.md)
  `CVE-2026-54675` · CVE record: FreePBX security-reporting · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal, Unrestricted file upload
- [Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload](https://agentprime.io/advisories/CVE-2026-101071.md)
  `CVE-2026-101071` · CVE record: Acrel Electric Unet Web Service · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [Authenticated File Write via HA Failover Config Upload leads to RCE](https://agentprime.io/advisories/CVE-2026-12264.md)
  `CVE-2026-12264` · CVE record: Zohocorp DDI Central · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Unrestricted file upload
- [Authenticated File Write to RCE via keepalived in DDI Central](https://agentprime.io/advisories/CVE-2026-12269.md)
  `CVE-2026-12269` · CVE record: Zohocorp DDI Central · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Unrestricted file upload
- [Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus](https://agentprime.io/advisories/CVE-2026-85134.md)
  `CVE-2026-85134` · CVE record: Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Unrestricted file upload
- [Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field](https://agentprime.io/advisories/CVE-2026-82901.md)
  `CVE-2026-82901` · CVE record: themefic Ultra Addons for Contact Form 7 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Unrestricted file upload
- [Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0](https://agentprime.io/advisories/CVE-2026-94132.md)
  `CVE-2026-94132` · CVE record: acymailing.com AcyMailing Enterprise extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Unrestricted file upload
- [Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler](https://agentprime.io/advisories/CVE-2026-18143.md)
  `CVE-2026-18143` · CVE record: Addify Request a Quote for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Unrestricted file upload
- [GestSup before 3.2.62 Remote Code Execution via IMAP Attachment](https://agentprime.io/advisories/CVE-2026-100389.md)
  `CVE-2026-100389` · CVE record: GestSup GestSup · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Unrestricted file upload
- [Piwigo: Authenticated RCE via File Upload in Logo Upload Feature](https://agentprime.io/advisories/CVE-2026-42322.md)
  `CVE-2026-42322` · CVE record: Piwigo Piwigo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Unrestricted file upload
- [Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface](https://agentprime.io/advisories/CVE-2026-13248.md)
  `CVE-2026-13248` · CVE record: Honeywell PD45 Industrial Printer · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal, Command injection, Unrestricted file upload
- [Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040](https://agentprime.io/advisories/CVE-2026-13249.md)
  `CVE-2026-13249` · CVE record: Honeywell PD45 Industrial Printer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection, Authentication bypass, Unrestricted file upload
- [Command Injection Vulnerability in Netlink ICT HG323RW Router](https://agentprime.io/advisories/CVE-2026-96515.md)
  `CVE-2026-96515` · CVE record: Netlink ICT Pvt Ltd Netlink ICT HG323RW Router · CVSS 8.6 High · Not analysed yet · Published 24 Sept 2026 · Tags: Unrestricted file upload, Broken access control
- [Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload](https://agentprime.io/advisories/CVE-2026-93352.md)
  `CVE-2026-93352` · CVE record: plank laravel-mediable · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Unrestricted file upload
- [Neethuharii CafeManagement AddProductCode.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-96513.md)
  `CVE-2026-96513` · CVE record: Neethuharii CafeManagement · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [Multiple vulnerabilities in the Microweber administration panel](https://agentprime.io/advisories/CVE-2026-5695.md)
  `CVE-2026-5695` · CVE record: Microweber Administration panel · CVSS 8.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: Unrestricted file upload
- [theRealSain Pixtream post_upload.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-95830.md)
  `CVE-2026-95830` · CVE record: theRealSain Pixtream · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload](https://agentprime.io/advisories/CVE-2026-95820.md)
  `CVE-2026-95820` · CVE record: anirbandutta9 College-Notes-Gallery · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload](https://agentprime.io/advisories/CVE-2026-95500.md)
  `CVE-2026-95500` · CVE record: JosephChuks php-file-manager-with-code-editor · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-95499.md)
  `CVE-2026-95499` · CVE record: JosephChuks php-file-manager-with-code-editor · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to…](https://agentprime.io/advisories/CVE-2026-88419.md)
  `CVE-2026-88419` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Unrestricted file upload
- [Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database](https://agentprime.io/advisories/CVE-2026-52835.md)
  `CVE-2026-52835` · CVE record: Tautulli Tautulli · CVSS 7.0 High · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, Unrestricted file upload
- [MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension](https://agentprime.io/advisories/CVE-2026-94383.md)
  `CVE-2026-94383` · CVE record: MISP MISP · CVSS 8.6 High · Not analysed yet · Published 21 Sept 2026 · Tags: Unrestricted file upload, CWE-20
- [WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-82187.md)
  `CVE-2026-82187` · CVE record: Unknown Web to Print Online Designer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Unrestricted file upload
- [EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.](https://agentprime.io/advisories/CVE-2026-88745.md)
  `CVE-2026-88745` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Jazzware RT1000 Edge webUI v.](https://agentprime.io/advisories/CVE-2026-88738.md)
  `CVE-2026-88738` · CVE record · CVSS 8.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: Unrestricted file upload
- [Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the…](https://agentprime.io/advisories/CVE-2026-36467.md)
  `CVE-2026-36467` · CVE record · CVSS 7.2 High · Not analysed yet · Published 21 Sept 2026 · Tags: Unrestricted file upload
- [Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7](https://agentprime.io/advisories/CVE-2026-88857.md)
  `CVE-2026-88857` · CVE record: OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Unrestricted file upload
- [NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager](https://agentprime.io/advisories/CVE-2026-94104.md)
  `CVE-2026-94104` · CVE record: nivocart nivocart · CVSS 8.7 High · Not analysed yet · Published 20 Sept 2026 · Tags: Unrestricted file upload
- [NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import](https://agentprime.io/advisories/CVE-2026-81650.md)
  `CVE-2026-81650` · CVE record: Unknown Photo Gallery, Sliders, Proofing and Themes · CVSS 7.2 High · Not analysed yet · Published 20 Sept 2026 · Tags: Unrestricted file upload
- [Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field](https://agentprime.io/advisories/CVE-2026-84750.md)
  `CVE-2026-84750` · CVE record: Unknown Ultra Addons for Contact Form 7 · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Unrestricted file upload
- [Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field](https://agentprime.io/advisories/CVE-2026-84434.md)
  `CVE-2026-84434` · CVE record: Gravity Forms Gravity Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2026 · Tags: Unrestricted file upload
- [WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import](https://agentprime.io/advisories/CVE-2026-93031.md)
  `CVE-2026-93031` · CVE record: WP Cloud Plugins/\_deleeuw\_ Use-your-Drive | Google Drive plugin for WordPress and 3 more · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Unrestricted file upload
- [ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint](https://agentprime.io/advisories/CVE-2026-77929.md)
  `CVE-2026-77929` · CVE record: MacWarrior clipbucket-v5 · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Unrestricted file upload
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-56590.md)
  `CVE-2026-56590` · CVE record: HCL Software HCL BigFix Service Management · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Unrestricted file upload
- [Chamilo LMS CStudio upload flow allows unauthenticated remote code execution](https://agentprime.io/advisories/GHSA-g4c3-4g96-6g4m.md)
  `GHSA-g4c3-4g96-6g4m`, `CVE-2026-45140`, `PKSA-m8ms-hgzz-8ddw` · Packagist `chamilo/chamilo-lms`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Code injection, Unrestricted file upload, CWE-219
- [HortusFox-Web < 6.1 Remote Code Execution via Import/Export](https://agentprime.io/advisories/CVE-2026-92980.md)
  `CVE-2026-92980` · CVE record: danielbrendel hortusfox-web · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Unrestricted file upload
- [Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload](https://agentprime.io/advisories/CVE-2026-87796.md)
  `CVE-2026-87796` · CVE record: sh1zen Multi Uploader for Gravity Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Unrestricted file upload
- [Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action](https://agentprime.io/advisories/CVE-2026-87935.md)
  `CVE-2026-87935` · CVE record: ichurakov Paid Downloads · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Unrestricted file upload

Newest: <https://agentprime.io/advisories/tag/file-upload.md>
Older: <https://agentprime.io/advisories/tag/file-upload.md?cursor=WyIyMDI2LTA5LTE3VDA0OjI4OjE0LjY5NjAwMFoiLCJDVkUtMjAyNi04NzkzNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-upload&cursor=WyIyMDI2LTEwLTAyVDIyOjQ0OjI2LjAwMDAwMFoiLCJHSFNBLXYyZjgtNjY1NS03Z3JqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-upload/?cursor=WyIyMDI2LTEwLTAyVDIyOjQ0OjI2LjAwMDAwMFoiLCJHSFNBLXYyZjgtNjY1NS03Z3JqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.