Weakness / #19
CWE-434: Unrestricted file upload in CISA KEV
Unrestricted Upload of File with Dangerous Type
Answer 24 KEV entries list CWE-434 (Unrestricted file upload) as of catalog 2026.10.30, 1.4% of the catalog and rank 19 of 198 weaknesses. The most affected vendor is Adobe (2).
An attacker can upload a file, such as a web shell, that the server will then execute.
- KEV entries
- 241.4% of catalog
- Vendors
- 22affected
- Ransomware: known
- 625%
- First added
- 2021-11-03
- Latest added
- 2026-10-27
VVendors
TAdditions by year
| Year | Added |
|---|---|
| 2021 | 6 |
| 2022 | 4 |
| 2023 | 0 |
| 2024 | 2 |
| 2025 | 4 |
| 2026 | 8 |
PProducts
| Product | Entries | Share |
|---|---|---|
| Apache Tomcat | 2 | 8.3% |
| Adobe Commerce and Magento | 1 | 4.2% |
| Balbooa Forms | 1 | 4.2% |
| iCagenda iCagenda | 1 | 4.2% |
| JoomShaper SP Page Builder | 1 | 4.2% |
| Samsung MagicINFO 9 Server | 1 | 4.2% |
| Kentico Kentico Xperience | 1 | 4.2% |
| TeamT5 ThreatSonar Anti-Ransomware | 1 | 4.2% |
EAll entries
| CVE | Vendor | Product | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-48356 | Adobe | Commerce and Magento | New | Unknown |
| CVE-2026-56291 | Balbooa | Forms | Unknown | |
| CVE-2026-48939 | iCagenda | iCagenda | Unknown | |
| CVE-2026-48908 | JoomShaper | SP Page Builder | Unknown | |
| CVE-2024-7399 | Samsung | MagicINFO 9 Server | Unknown | |
| CVE-2025-2749 | Kentico | Kentico Xperience | Unknown | |
| CVE-2024-7694 | TeamT5 | ThreatSonar Anti-Ransomware | Unknown | |
| CVE-2025-52691 | SmarterTools | SmarterMail | Known | |
| CVE-2018-4063 | Sierra Wireless | AirLink ALEOS | Unknown | |
| CVE-2021-26828 | OpenPLC | ScadaBR | Unknown | |
| CVE-2025-31324 | SAP | NetWeaver | Known | |
| CVE-2024-57968 | Advantive | VeraCore | Unknown | |
| CVE-2024-50623 | Cleo | Multiple Products | Known | |
| CVE-2024-39717 | Versa | Director | Unknown | |
| CVE-2017-12617 | Apache | Tomcat | Unknown | |
| CVE-2017-12615 | Apache | Tomcat | Known | |
| CVE-2020-13671 | Drupal | Drupal core | Unknown | |
| CVE-2021-27860 | FatPipe | WARP, IPVPN, and MPVPN software | Unknown | |
| CVE-2021-31207 | Microsoft | Exchange Server | Known | |
| CVE-2021-20022 | SonicWall | SonicWall Email Security | Known | |
| CVE-2020-8260 | Ivanti | Pulse Connect Secure | Unknown | |
| CVE-2020-25213 | WordPress | File Manager Plugin | Unknown | |
| CVE-2019-8394 | Zoho | ManageEngine | Unknown | |
| CVE-2018-15961 | Adobe | ColdFusion | Unknown |
Cite this
24 CISA KEV entries list CWE-434 (Unrestricted file upload), 1.4% of the catalog. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/cwe-434/
Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.