file_upload vulnerabilities
file_upload in numbers
sbomify tracks 5,611 file_upload vulnerabilities. Most are found in web application (62%), cms plugin (23%) and server software (8%).
How to fix file_upload vulnerabilities
Most exploited file_upload vulnerabilities
- CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type
- CVE-2026-56290 Joomlack Page Builder Improper Access Control
- CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type
- CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type
- CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control
- CVE-2025-52691 SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type
- CVE-2020-25213 WordPress File Manager Plugin Remote Code Execution
- CVE-2024-57968 Advantive VeraCore Unrestricted File Upload
- CVE-2021-38163 SAP NetWeaver Unrestricted File Upload
- CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload
- CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of File
- CVE-2022-26871 Trend Micro Apex Central Arbitrary File Upload
Recently published
- CVE-2026-107188 Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
- CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
- CVE-2026-112149 vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload
- CVE-2026-103768 File upload in ELEX WordPress HelpDesk & Customer Ticketing System
- CVE-2026-109219 Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
- CVE-2026-111311 File upload in DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.