Module 12 · File Upload Vulnerabilities 🔒

File upload features are everywhere — profile pictures, document uploads, attachments, imports. They’re also one of the most frequently-exploited vulnerability classes, capable of escalating from “user” to “RCE” in one click. This module covers the attack patterns and the layered defences.

The attack surface

1. Attacker uploads a file (malicious)
2. Server saves file to disk
3. Server (or another process) later interacts with the file — serves it to users, renders it, executes it, parses it

Each interaction is a potential exploit vector. The upload itself rarely causes the damage; it’s what happens afterwards.

Classic RCE via upload

App accepts profile pictures. Doesn’t validate content. Saves to /uploads/. Webserver executes PHP in /uploads/. Attacker uploads shell.php. Navigates to /uploads/shell.php?cmd=whoami. Shell executed as web-server user.