File upload vulnerabilities occur when an application accepts a file without properly validating its type, content, or storage location, letting an attacker upload a web shell or malicious file that the server then executes or serves. The worst case is uploading a script (such as a .php file) into a web-accessible, executable directory, giving remote code execution. The fix combines server-side type validation, storing uploads outside the web root, and never executing uploaded content.
What file upload vulnerabilities are
Upload features are everywhere: avatars, documents, images. They become vulnerabilities when the server trusts the uploaded file too much, accepting a dangerous type, trusting a client-supplied content type, or saving the file somewhere it can be executed.
The headline risk is uploading a web shell: a small script that, once placed in an executable web directory, lets the attacker run commands through their browser. Uploads also enable stored XSS (SVG/HTML), XXE (SVG/DOCX), and path traversal in the filename.
How it works and example
The attacker tries to get an executable file into an executable location:
- Upload
shell.phpcontaining<?php system($_GET[0]); ?>and browse to it to run commands. - Bypass weak filters: double extensions (
shell.php.jpg), null bytes, case (.pHp), or trusting the clientContent-Type. - Bypass magic-byte checks by prepending valid image headers to a polyglot file.
- Path traversal in the filename (
../../shell.php) to escape the upload directory. - Upload an SVG with embedded script (stored XSS) or external entities (XXE).
Examples shown for defensive context.
How to fix it
- Validate type server-side by content, not the client-supplied extension or Content-Type, and allow-list permitted types.
- Store uploads outside the web root and serve via a controlled handler, so they are never executed.
- Rename files to server-generated names and strip path components from the original filename.
- Disable script execution in the upload directory (web-server config).
- Scan and size-limit uploads, and treat SVG/Office files as active content.
- Test the upload flow for filter bypasses.
References
- [1]OWASP: File Upload(OWASP)
- [2]MITRE CWE-434: Unrestricted Upload of File with Dangerous Type(MITRE CWE)
- [3]OWASP Top 10(OWASP)