Insecure file uploads
Without the right protection, someone can send a malicious file disguised as a photo or document — and turn your upload field into a way in.
What it is
Many apps let users send files: a profile photo, a receipt, a document. The flaw happens when the app accepts any file without properly checking what it is and what it can do once it's stored.
- Easy disguiseA dangerous file can pass as an image just by changing its name or appearance — and the app accepts it.
- Stored in the wrong placeIf the uploaded file lands somewhere it can be executed, it stops being data and becomes a program.
- Trusting what arrivesThe root cause is the app trusting that "a photo is a photo," without truly confirming the contents.
How an attacker uses it
The attacker sends a crafted file through the very field you built for photos, and tries to make the server run it.
- Uploads the disguised fileThey send a malicious file looking like an image or PDF through the app's ordinary upload.
- Makes it executeIf the server treats the file as a program, the attacker runs commands on your machine remotely.
- Turns it into a footholdFrom there they settle in, dig deeper, and use your server as a base for other attacks.
Where it usually shows up
It shows up in any app with "upload a photo," "attach a document," or "import a file" built without the right validation.
- Profile photos and attachmentsAvatar, receipt, and attachment fields are the classic spots, present in almost every app.
- Spreadsheet imports"Import from Excel" screens also receive files and can fall into the same flaw.
- Built fastMaking the upload "work" is simple; validating the contents and storing safely is the step that tends to be missing.
How we find and fix it
We try sending files that shouldn't get through, see how far they reach, and help you harden the upload end to end.
- We test the uploadWe try to upload disguised and dangerous files to see what the app accepts and what it does with them.
- We follow the pathWe check where the file is stored and whether there's any way to force it to execute later.
- We harden the fieldWe help truly validate the contents, store files away from execution, and limit what can be sent.
Is one of these your pain?
Tell us your case — in the scoping call we confirm whether it can be automated and show you the upside before you decide. No obligation.
Start a project