BERRY9 IT Services, home +91 86868 92922

File Upload Vulnerabilities: From Webshell to RCE

Unrestricted file upload is one of the most reliable paths from anonymous access to remote code execution. The vulnerability requires three things to align: (1) the server accepts a file with an executable extension, (2) the file is stored inside the webroot or a path the application later executes, and (3) the server can be coerced into executing it. Defenses fail at any of these three points.

Request a scoping call Call +91 86868 92922

Web applications · By Thimmagurudu Bathini · Published · 7 min read · Last reviewed

Extension check failures

The most common failure is client-side or blacklist-based extension validation. Bypasses testers use:

  • Case variations — .PhP, .PHP3, .phtml, .phar
  • Double extensions — shell.jpg.php, shell.php.jpg with Apache AddHandler misconfig
  • Null bytes — shell.php%00.jpg on older PHP/CGI stacks
  • Trailing dots and spaces — shell.php., shell.php on Windows
  • Polyglot files — valid GIF/JPG header plus PHP/JSP code in metadata or after the image data

Content-type and magic-byte checks

Both are bypassable. Content-Type comes from the client. Magic bytes can be prepended to almost any payload. The only reliable signal is the actual file contents, parsed by a hardened library that rejects anything unexpected.

Path traversal in stored filenames

If the uploaded filename is used unsanitized, ../../../var/www/html/shell.php can land anywhere. Combine with an SVG that contains JavaScript and you have stored XSS at minimum.

Defenses that actually work

  1. Allowlist extensions (not blacklist) — explicitly list the four or five you accept
  2. Store uploads outside the webroot, serve them through an application proxy that sets Content-Disposition
  3. Rename every upload to a server-generated UUID — never trust the client filename
  4. For images, re-encode through a hardened library (Pillow, Sharp); for documents, render to PDF and discard the original
  5. Set X-Content-Type-Options: nosniff on serving responses

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp