Common Weakness Enumeration
CWE-646 Reliance on File Name or Extension of Externally-Supplied File
Description
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-646 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-m8f9-9whg-f4xr | CVE-2026-45315 | HIGH |
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions |
2026-05-19 | |
| GHSA-vgmm-27fc-vmgp | CVE-2025-58449 | HIGH | - |
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload |
2025-09-09 |
| GHSA-769v-p64c-89pr | CVE-2025-1889 | MODERATE |
PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions |
2025-03-06 | |
| GHSA-hw34-rqc5-h2gm | - | MODERATE |
Duplicate Advisory: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis |
2025-03-03 |