Description
The <input> element with type="file" enables users to select and upload files from their device storage to a remote server. However, unrestricted file upload functionality can introduce an arbitrary file upload vulnerability, allowing malicious users to upload and potentially execute any file on the server.
Recommendation
To mitigate this risk:
- Implement restrictions on the file types and sizes that users can upload.
- Ensure that uploaded files are stored securely and are not publicly accessible on the web server.
Could your website be exposed too?
SmartScanner can check your website for File Upload Functionality and gives you actionable findings to investigate.
Start a free scanRelated Issues
- VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
- CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover - CVE-2024-43411
- Remote File Disclosure - Vulnerability
- Remote File Inclusion - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024