thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Unrestricted File Upload

Allowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.

Definition

Defenses include allowlisting extensions and verifying content type and magic bytes, renaming files server-side, storing uploads outside the web root or in object storage, serving them with a safe Content-Type and Content-Disposition, size limits and malware scanning. Tracked as CWE-434.

Example

An avatar upload accepts a .php file that the web server then executes.

Exam tip

Store outside the web root and never trust the client-supplied MIME type.

Related terms