File upload features, such as avatars, attachments and document imports, are a favourite target. If the server trusts the file name, extension or content type sent by the browser, an attacker can upload something far more dangerous than a picture.

How it happens

The attacker uploads a script disguised as an image, a file with a double extension, or a "polyglot" that is valid as two file types at once. If the file lands in a web-accessible folder and the server executes it, the attacker has a web shell. Very large files can also exhaust disk space or memory.

Why it matters

• Remote code execution through an uploaded web shell.
• Stored XSS through uploaded HTML or SVG files.
• Denial of service through oversized uploads.

How to prevent it

• Allow-list extensions and verify the actual file content, not just the MIME type.
• Rename uploaded files and store them outside the web root, or in separate object storage.
• Serve uploads with a safe Content-Type and Content-Disposition: attachment.
• Enforce size limits and scan files for malware.

How Vooki Pro helps

• Tests file upload handling, file-type bypasses, polyglot files and large-file denial of service.
• Checks for path traversal in file names and for zip slip in archives.
• Supports scanning upload endpoints in APIs, including multipart form data built in the API Builder.
• Provides step-by-step reproduction so developers can confirm the issue themselves.

Frequently asked questions

Is checking the file extension enough?

No. Attackers can fake extensions and MIME types. Verify the file content, rename files and store them outside the web root.

Can an image upload lead to XSS?

Yes. SVG files and HTML disguised as images can run scripts if they are served with an unsafe content type from your domain.

Related: Path traversal, local and remote file inclusion · Cross-site request forgery (CSRF)