Home / Knowledge hub / File upload vulnerability
Knowledge hub
File upload vulnerability
An upload feature that accepts files it should refuse, such as scripts.
What it means
A file upload vulnerability exists when an upload feature accepts files it should refuse, or stores and serves them unsafely. A profile photo form that also takes a script, or keeps the name the user chose, is a typical case.
Uploads are a way for an outsider to put their own content on your server. Everything depends on what you then do with it: where it is stored, what it is called, and how it is served back. A single weak step in that chain, such as serving the file from a folder that runs scripts, is enough to turn a harmless-looking form into a way in.
Why it matters
The worst outcome is a file the server runs. An uploaded script in a web-accessible folder can give an attacker control of the server. Other outcomes include overwriting important files through a crafted name, stored scripts in HTML or SVG files that run in other visitors' browsers, and huge files that fill storage.
Uploads also bring legal and customer risk, since your platform can end up hosting malware or illegal material, and users can receive a harmful file from a source they trust. Customers and partners hold you responsible for what your service hosts and hands back to them, whoever uploaded it.
How it shows up
You meet it in avatars, document attachments, import tools, support ticket forms and CV uploads. Common mistakes: trusting the file name or the Content-Type header the client sends, checking only the extension, keeping the original name, and storing files where the web server can execute them.
OWASP's guidance is to allow only needed types by an allowlist, check content as well as extension, rename files on arrival, store them outside the web root or in separate object storage, limit size, scan for malware and serve with safe headers. See content-type validation and path traversal.
Questions people ask
File upload vulnerability, answered
Is checking the file extension enough?
No. Extensions are easy to fake or double, and the type the browser reports is under the sender's control.
Check the real content too, rename the file, and make sure the storage location cannot run it.
What is a web shell?
A web shell is a small script uploaded to a server that lets its owner run commands through a web page. It is a common goal of an unsafe upload.
It works only if the server will execute the file where it was stored.
Can an image upload be dangerous?
Yes. SVG files can carry scripts, and some image files hide other content. Image libraries have also had bugs triggered by crafted files.
Re-encoding images on the server removes much of the risk.
Where should uploaded files be stored?
Away from your application code, in a location that cannot execute files, such as separate object storage under another domain.
Serve them with a fixed content type and a header that stops browsers guessing.
How do we test an upload feature?
Try files with wrong extensions, double extensions, odd names, oversized content and a script in a harmless form, then see what is stored and how it is served.
Confirm nothing uploaded can run or overwrite anything.
Related
Terms that sit next to this one
Content-type validation
Checking what a request or upload really is, not just what it says it is.
Path traversal
Using a crafted file name to reach files outside the intended folder.
Remote code execution
Getting a server to run commands of an attacker's choosing.
Malware
Software built to damage systems, steal data or give an attacker control.
Stored XSS
Malicious script saved by your app and then served to other people who view it.
What happens to a file after it lands?
Uploads are where outsiders put content on your server. We test what your upload features accept, where files land and how they are served, and report only what we proved. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.