CWE-434 危险类型文件的不加限制上传 类弱点 2445 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-434 属于不安全的文件上传漏洞，指系统允许上传并自动处理危险类型的文件。攻击者通常利用此缺陷上传恶意脚本或可执行文件，进而通过服务器自动执行功能获取系统控制权或植入后门。开发者应避免仅依赖文件扩展名验证，需结合内容检测、白名单机制及隔离存储策略，严格限制可上传的文件类型，从而有效阻断此类攻击路径。
<form action="upload_picture.php" method="post" enctype="multipart/form-data"> Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> </form>// Define the target location where the picture being // uploaded is going to be saved. $target = "pictures/" . basename($_FILES['uploadedfile']['name']); // Move the uploaded file to the new location. if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target)) { echo "The picture has been successfully uploaded."; } else { echo "There was an error uploading the picture, please try again."; }<form action="FileUploadServlet" method="post" enctype="multipart/form-data"> Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> </form>public class FileUploadServlet extends HttpServlet { ... protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html"); PrintWriter out = response.getWriter(); String contentType = request.getContentType(); // the starting position of the boundary header int ind = contentType.indexOf("boundary="); String boundary = contentType.substring(ind+9); String pLine = new String(); String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value // verify that content type is multipart form data iCWE-434（危险类型文件的不加限制上传） 是常见的弱点类别，本平台收录该类弱点关联的 2445 条 CVE 漏洞。