Web SecurityHighMalicious file upload
Unrestricted File Upload
Weak upload validation lets attackers store executable or malicious files on the server.
Overview
When type/extension/content checks are missing or bypassable, an attacker uploads a web shell, polyglot, or SVG that executes, or stores content served to other users.
How it works
When type/extension/content checks are missing or bypassable, an attacker uploads a web shell, polyglot, or SVG that executes, or stores content served to other users.
Example
Impact
Remote code execution, stored XSS via SVG/HTML, and content-spoofing.
Detection
Attempt typed/double-extension/polyglot uploads and verify whether the stored file is executed or served with a dangerous type.
Prevention
- Validate by content type and re-encode images server-side.
- Store uploads off the web root or on object storage with no execution.
- Generate random filenames and force safe Content-Type/Content-Disposition.