# Insecure File Upload

> Detects file upload handlers that lack extension validation, MIME type checking, or store files in web-accessible directories.

- Skill: `zakirkun/insecure-file-upload` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/insecure-file-upload`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/insecure-file-upload/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/insecure-file-upload

---


# Insecure File Upload

## Overview
Unrestricted file upload allows attackers to upload web shells (PHP, JSP, ASPX) or other malicious files that can then be executed by the server. This often leads to Remote Code Execution.

Attack scenarios:
1. Upload `shell.php` — server executes it if stored in webroot
2. Upload a file with double extension: `shell.php.jpg` — some servers still execute
3. Upload SVG with embedded XSS — client-side attack
4. Upload oversized file — DoS via disk exhaustion

## Detection Strategy
- `move_uploaded_file()` without extension whitelist check
- `multer` storage without file type validation
- Upload directory inside webroot
- Trust of `Content-Type` header alone (user-controlled)

## Remediation
- Whitelist allowed extensions (not blacklist)
- Validate MIME type using file content (magic bytes), not only headers
- Store uploaded files outside webroot
- Rename uploaded files to random UUIDs
- Scan with antivirus for high-risk applications
- Set file size limits