Cyber Resilience

CWE · MITRE source

CWE-434Unrestricted Upload of File with Dangerous Type

Abstraction: Base · CVEs in our corpus: 4,304

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Last updated: 22 August 2026 00:25 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A06:2025 Insecure Design.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-44 Detonation Chambers
  • SC-51 Hardware-based Protection
  • MP-7 Media Use
  • SI-3 Malicious Code Protection
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V5.1.1

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control Title Family Why it addresses this CWE
SC-44Detonation ChambersSCDangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
SC-51Hardware-based ProtectionSCPrevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
MP-7Media UseMPRequiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
SI-3Malicious Code ProtectionSIScans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-24186 10.010.00.94622020-08-24
CVE-2020-25213 KEV 10.010.00.97332020-09-09
CVE-2020-35489 10.010.00.89282020-12-17
CVE-2025-31324 KEV 10.010.00.99512025-04-24
CVE-2025-52691 KEV 10.010.00.85462025-12-29
CVE-2016-3088 KEV 9.99.80.98522016-06-01
CVE-2017-9101 9.99.80.76742017-05-21
CVE-2017-11357 KEV 9.99.80.75712017-08-23
CVE-2018-15961 KEV 9.99.80.99952018-09-25
CVE-2018-9206 9.99.80.97262018-10-11
CVE-2019-7257 9.910.00.69992019-07-02
CVE-2014-8516 9.99.80.81682020-01-03
CVE-2013-7390 9.99.80.74532020-01-27
CVE-2020-6754 9.99.80.94802020-02-05
CVE-2014-8739 9.99.80.91662020-02-08
CVE-2013-0803 9.99.80.74982020-02-11
CVE-2020-12800 9.99.80.78752020-06-08
CVE-2021-3378 9.99.80.97512021-02-01
CVE-2020-28871 9.99.80.85792021-02-10
CVE-2021-37539 9.99.80.92872021-09-27
CVE-2021-27860 KEV 9.99.80.39822021-12-08
CVE-2023-5360 9.99.80.81692023-10-31
CVE-2023-46263 9.99.80.81882023-12-19
CVE-2023-46264 9.99.80.90192023-12-19
CVE-2024-50623 KEV 9.99.80.98612024-10-28