CWE-434 Unrestricted Upload of File with Dangerous Type

Ghost : Stored XSS via SVG Files in Content Imports

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Payload: Bypassed sanitization of user uploaded SVGs

Payload: Uploaded XML files could execute same-origin JavaScript

Ghost: Stored XSS via Bookmark Card Images

Ghost: Stored XSS via File Uploads on Local Storage

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

carbon-apimgt does not properly restrict uploaded files

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Ghost: File Upload Content-Type Spoofing

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

class.upload.php in verot.net omits .pht from the set of dangerous file extensions

Remote code execution in verot/class.upload.php

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)