Unrestricted File Upload
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload means the application accepts files without adequately controlling their type, name, or where they are stored. If an attacker can upload a server-side script and then request it, the web server executes it, giving the attacker a web shell. Even when execution is blocked, uploaded HTML or SVG files served from the application's origin can deliver stored XSS, and oversized or malformed files can exhaust resources.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A profile picture upload checks only the Content-Type header, so shell.php sent as image/jpeg is saved in a web-accessible folder and executed.
- A double extension such as invoice.pdf.php or a case trick such as shell.PhP slips past a block-list.
- An uploaded SVG containing script is served from the main domain and runs in the browser of anyone who views it.
How to mitigate it
- Allow-list permitted file types and verify the actual content, not just the extension or Content-Type header.
- Store uploads outside the web root, or on a separate domain or object store configured never to execute content.
- Generate new random file names on the server and discard the client-supplied name.
- Enforce size limits, scan uploads for malware, and serve user files with Content-Disposition: attachment and a restrictive Content-Type.
Go deeper
Practice this topic
Test your knowledge of Unrestricted File Upload with exam-style practice questions.