File Upload Vulnerabilities
A file upload vulnerability lets an attacker upload a file the server should have rejected, and in the worst case run code from it. The attacks are extension bypasses, content type spoofing and path manipulation. Whether it is a medium or a critical finding comes down to one thing: is the upload directory web accessible and executable.
Why file uploads are dangerous
An upload feature accepts data from an untrusted user and stores it on the server. If the validation is weak and the stored file can be executed, an attacker uploads a web shell and runs commands. That is remote code execution, the highest severity outcome in web testing.
The bypass techniques
| Technique | How it works |
|---|---|
| Double extension | shell.php.jpg passes a check on the last part |
| Null byte | shell.php%00.jpg on older stacks |
| Content type spoof | Send image/jpeg header for a PHP file |
| Magic byte spoof | Prepend real image bytes to a script |
| Case variation | shell.PhP against a lowercase blocklist |
| Path traversal | Filename with ../ to escape the upload dir |
From upload to shell
The chain: bypass validation, upload a web shell, find where it landed, browse to it, and run commands. The critical question at each step is whether the server will execute the file. A PHP file in a directory that runs PHP is game over; the same file in a directory served as static downloads is harmless.
<?php system($_GET['cmd']); ?>That one line, if uploaded and executed, is a command shell. This is why upload validation matters so much.
What decides severity
- Is the upload directory inside the web root
- Can the server execute files there
- Is the filename predictable so you can find it
- Are dangerous types actually blocked
Report the impact, not just the bypass. Reached RCE is critical; an upload that lands in a non executable, non web accessible store is far lower.
The fixes that hold
- Allowlist extensions, never blocklist
- Verify content, not just the claimed type
- Store uploads outside the web root, or in object storage
- Rename files to random values, strip the original extension
- Serve uploads with a content disposition that forces download
- Never execute anything from the upload directory
Input validation alone is not enough; the storage and execution decisions matter more. This connects to the OWASP Top 10, covered in OWASP Top 10 explained.
Practise this
Upload a web shell to a deliberately vulnerable app and reach RCE, then fix it. Free labs on Hacklido.
Enroll in Web Pentesting
Live instructor led training with hands on labs and a verifiable certificate. Or start free on Hacklido.
Enroll in Web Pentesting