File Upload Vulnerabilities
A file upload feature lets users put data on your server — and lets attackers try to put code there. Uploads are dangerous precisely because they combine untrusted input with the file system: get it wrong and a “profile picture” becomes a web shell granting remote code execution. Accepting files safely is entirely possible, but it takes deliberate controls, not just an extension check.
What can go wrong?#
| Weakness | Consequence |
|---|---|
| Executable upload in web root | Remote code execution (web shell) |
| Trusting the file extension/MIME | Disguised malicious file accepted |
| Serving uploads inline | Stored XSS via HTML/SVG |
| Path in filename | Path traversal, overwrite files |
| No size limit | Denial of service |
The worst case is an uploaded script that the server will execute — a direct path from “upload” to “attacker runs commands as the web server.”
How do you accept files safely?#
Layer independent controls, because any single check can be fooled:
- Validate by content, not extension or client MIME — inspect the actual bytes.
- Store outside the web root or in object storage, never where they can be executed.
- Rename to random, server-generated names — discard the user’s filename entirely.
- Serve from a separate domain with
Content-Disposition: attachmentwhere possible. - Enforce size and type limits, and scan for malware where warranted.
File upload security combines input validation and safe storage. More at the Web Security hub.
Frequently asked questions#
Why are file uploads dangerous?
An upload feature lets untrusted users place files on your server. If those files can be executed (a web shell), stored where they are served as code, or trusted by their claimed type, an attacker can achieve remote code execution, cross-site scripting, or overwrite important files. Uploads combine untrusted input with the file system.
How do you secure file uploads?
Validate the file type by content, not just extension or the client-provided MIME type; store uploads outside the web root or on separate storage; give them random server-generated names; never execute uploaded files; and enforce size limits. Serving from a distinct domain further contains any malicious content.