CWE-646

Reliance on File Name or Extension of Externally-Supplied File

High

Description

The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

Potential Impact

How to Fix

Architecture and Design

Make decisions on the server side based on file content and not on file name or extension.

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-646 vulnerabilities in your codebase.

Get Security Assessment