CWE-434 on After the Code

CWE-434 on After the Codehttps://windshock.github.io/en/tags/cwe-434/Recent content in CWE-434 on After the CodeHugo -- 0.145.0en-USMon, 02 Nov 2026 00:00:00 +0000The O’Reilly Curse: When 20-Year-Old Java Upload Code Becomes a Vulnerabilityhttps://windshock.github.io/en/post/2026-11-02-oreilly-cos-upload-curse/Mon, 02 Nov 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-11-02-oreilly-cos-upload-curse/A documented save-before-validation design in O’Reilly COS MultipartRequest, combined with first-file-only application validation, can leave an executable JSP behind in an image-upload flow. A CWE-434 case study through code, a reproduction walkthrough, and the proper fix.