{
  "slug": "file-upload-flaws",
  "url": "https://library.infinity8labs.com/file-upload-flaws/",
  "title": "File upload flaws",
  "short": "File upload",
  "aliases": [
    "Unrestricted file upload",
    "Unsafe file upload",
    "Malicious file upload"
  ],
  "summary": "File upload flaws let users store files with unsafe content, names, locations, or permissions. Consequences range from stored script execution and malware distribution to server-side code execution.",
  "cwe": [
    "CWE-434"
  ],
  "owasp": "A04:2021 Insecure Design",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-434: Unrestricted Upload of File with Dangerous Type",
      "url": "https://cwe.mitre.org/data/definitions/434.html"
    },
    {
      "title": "OWASP File Upload Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A04:2021 Insecure Design",
      "url": "https://owasp.org/Top10/A04_2021-Insecure_Design/"
    },
    {
      "title": "PortSwigger Web Security Academy: File upload vulnerabilities",
      "url": "https://portswigger.net/web-security/file-upload"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/file-upload-flaws/#overview",
    "https://library.infinity8labs.com/file-upload-flaws/#impact",
    "https://library.infinity8labs.com/file-upload-flaws/#examples",
    "https://library.infinity8labs.com/file-upload-flaws/#remediation",
    "https://library.infinity8labs.com/file-upload-flaws/#testing",
    "https://library.infinity8labs.com/file-upload-flaws/#references"
  ]
}