File Upload

What it is#

An upload handler that checks the wrong property of a file, or checks the right one but nothing else, lets an attacker get executable code onto the server, or a script into another user's browser, disguised as an ordinary file.

How it works#

$blocked = ['php', 'php3', 'php4', 'php5'];
$ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (!in_array(strtolower($ext), $blocked, true)) {
    move_uploaded_file($_FILES['file']['tmp_name'], "uploads/{$_FILES['file']['name']}");
}

A blacklist has to enumerate every dangerous extension a server might ever execute, such as .phtml or .pht on some stacks, and misses whatever it forgot.

Real-world impact#

Remote code execution: the classic outcome of an under-restricted file upload landing in a web-reachable, script-executing directory.

How to prevent it#

• Allow-list acceptable extensions; never blacklist dangerous ones.
• Never trust the client-sent Content-Type header for anything that decides how a stored file is served back later.
• Store uploads outside the webroot, or in a location explicitly configured to never execute scripts.