1055
This can have a chaining relationship with incomplete denylist / permissive allowlist errors
when the product tries, but fails, to properly limit which types of files are allowed (CWE-183,
CWE-184). This can also overlap multiple interpretation errors for intermediaries, e.g. anti-virus
products that do not remove or quarantine attachments with certain file extensions that can be
processed by client systems.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unrestricted File Upload
OWASP Top Ten 2007 A3 CWE More Specific Malicious File Execution
OMG ASCSM ASCSMCWE-