srl
File Upload Vulnerabilities
File upload vulnerabilities arise when a web server accepts user-supplied files without adequately validating their extension, content type, magic bytes, or destination path. The impact ranges from stored XSS to full remote code execution, and the attack surface has expanded in 2025–2026 with new WAF-parsing bypasses, framework-specific sanitizer flaws, and race-condition exploitation tools.
The impact depends on two factors:
Which part of the file is validated — size, type, contents, name, or none of them. Which restrictions apply after upload — whether the directory executes scripts, whether it is web-accessible, and whether configuration files can be dropped. 2025–2026 context: WAF-level file upload checks are now a distinct bypass class. CVE-2026-33691 (OWASP CRS whitespace padding) and CVE-2026-114101 (Coraza filename parsing) both allow dangerous extensions past the WAF without touching the application. Framework sanitizers have their own bugs — CVE-2026-48557 (Spatie Laravel Media Library) checks only the final suffix, letting shell.php.jpg through.