Catalog/VULNERABILITY/file-upload
SCAN-ID: FILE-UPLOADREVISION 2026.4
VULNERABILITYCVSS 9.0 (CRITICAL)

File Upload & Arbitrary Execution Scanner

Inspect file upload endpoints for dangerous extensions, MIME confusion, and stored executable payloads.

Technical Scope & Verification Behavior

Tests multi-part uploads with double extensions (.jpg.php), HTML/SVG script injection, directory traversal filename parameters, and zero-byte bypasses.

Automated Inspection Checks (8)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

Content-Disposition: name="file"; filename="avatar.php%00.png"

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Randomized Name & S3 Storage

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
fs.writeFileSync(`./uploads/${file.originalname}`, file.buffer);
+++ b/handler.typescript (Remediated)
const key = `${crypto.randomUUID()}.${ext}`;
await s3.upload({ Bucket: 'uploads', Key: key, Body: file.buffer });

Never store user uploads on local execution paths using the client-provided filename. Store in isolated object storage.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Generate a cryptographically random UUID for uploaded filenames and stream them directly to cloud storage with Content-Disposition: attachment."

Run Isolated Check

Test your public domain specifically for File Upload & Arbitrary Execution Scanner.

100% passive • No server load

Specification Details

CVSS Score
9.0 / 10.0
Severity Level
CRITICAL
Category
VULNERABILITY
Test Vectors
8 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#Upload#RCE#CWE-434

Run continuous monitoring for File Upload & Arbitrary Execution Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog