CWE-646 · 10 records

Reliance on File Name or Extension of Externally-Supplied File

CVEs in this class

10 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-38432No exploit	Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied Filematrix-globalservices · tafnit · CWE-646 Pre-auth	Critical9.8	—	0.2%	Jul 30, 2024
37Monitor	CVE-2024-52052No exploit	Stream Target Remote Code Execution in Wowza Streaming Enginewowza · streaming engine · CWE-646 RCE	Critical9.4	—	0.5%	Nov 21, 2024
35Monitor	CVE-2021-34639No exploit	WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Uploadw3eden · download manager · CWE-646 File upload	High8.8	—	0.6%	Aug 5, 2021
35Monitor	CVE-2023-45599No exploit	A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web applicatailux · imx6 · CWE-646	High8.8	—	0.2%	Mar 5, 2024
34Monitor	CVE-2025-58449No exploit	Maho Vulnerable to Authenticated Remote Code Execution via File Uploadmahocommerce · maho · CWE-646 RCE	High8.7	—	0.3%	Sep 8, 2025
26Monitor	CVE-2025-30662No exploit	Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Followingzoom · workplace virtual desktop infrastructure · CWE-646 Pre-auth	Medium6.5	—	0.1%	Nov 13, 2025
22Monitor	GHSA-hw34-rqc5-h2gmNo exploit	Duplicate Advisory: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static AnalysisPyPI · picklescan · CWE-646 pre-auth RCE	Medium5.5	—	—	Mar 3, 2025
21Monitor	CVE-2025-1889No exploit	picklescan - Security scanning bypass via non-standard file extensionsmmaitre314 · picklescan · CWE-646 Pre-auth	Medium5.3	—	0.4%	Mar 3, 2025
17Monitor	CVE-2025-41720No exploit	Sauter: Arbitrary File Uploadsauter · modulo 6 devices modu680-as · CWE-646 File upload	Medium4.3	—	0.2%	Oct 22, 2025
17Monitor	CVE-2026-20172No exploit	Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerabilitycisco · cisco enterprise chat and email · CWE-646	Medium4.3	—	0.1%	May 6, 2026

CVE-2024-38432
39Monitor
Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
matrix-globalservices · tafnitJul 30, 2024
CVE-2024-52052
37Monitor
Stream Target Remote Code Execution in Wowza Streaming Engine
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
wowza · streaming engineNov 21, 2024
CVE-2021-34639
35Monitor
WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload
HighCVSS 8.8No exploitEPSS 1%
- File upload
w3eden · download managerAug 5, 2021
CVE-2023-45599
35Monitor
A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web applicat
HighCVSS 8.8No exploitEPSS 0%
ailux · imx6Mar 5, 2024
CVE-2025-58449
34Monitor
Maho Vulnerable to Authenticated Remote Code Execution via File Upload
HighCVSS 8.7No exploitEPSS 0%
- RCE
mahocommerce · mahoSep 8, 2025
CVE-2025-30662
26Monitor
Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
zoom · workplace virtual desktop infrastructureNov 13, 2025
GHSA-hw34-rqc5-h2gm
22Monitor
Duplicate Advisory: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis
MediumCVSS 5.5No exploit
- pre-auth RCE
PyPI · picklescanMar 3, 2025
CVE-2025-1889
21Monitor
picklescan - Security scanning bypass via non-standard file extensions
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
mmaitre314 · picklescanMar 3, 2025
CVE-2025-41720
17Monitor
Sauter: Arbitrary File Upload
MediumCVSS 4.3No exploitEPSS 0%
- File upload
sauter · modulo 6 devices modu680-asOct 22, 2025
CVE-2026-20172
17Monitor
Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
MediumCVSS 4.3No exploitEPSS 0%
cisco · cisco enterprise chat and emailMay 6, 2026

All vulnerability classes