File Upload Security

Purpose

Guide pre-ship review of unrestricted or weakly restricted file uploads: content that is stored, served, or processed unsafely leading to RCE, XSS, traversal, or malware distribution.

When to Use / When Not to Use

Use when:

• Multipart endpoints, avatar/doc uploads, multer, Busboy, Django FileField, S3 presigned PUT, archive import, antivirus-less pipelines.
• After AXguard hits upload.* or related path.*.
• Uploaded files are later executed, included, or served as HTML/JS.

Do not use when:

• No file ingress exists (JSON-only APIs).
• Upload is delegated entirely to a hardened third-party with app-only metadata (still review URL/XSS when displaying).

Security Concepts

Upload risk is a pipeline: accept → name → store → process → serve. Controls must cover type (magic bytes + allowlist), size, path, virus/content policy, and Content-Type when serving. Extension checks alone are insufficient.

Threat Model

Attacker goals:

1. Upload executable/script into a webroot or template path.
2. Store HTML/SVG that executes as XSS when served.
3. Zip-slip / oversized archives (DoS) during extract.
4. Polyglot files that bypass MIME sniffing or image pipelines (ImageTragick-class).

Analysis Workflow

1. Map upload endpoints and storage destinations (disk, S3, CDN).
2. Check extension allowlist vs denylist; confirm MIME and magic-byte validation.
3. Inspect filename handling — user-controlled names vs random object keys.
4. Determine if files are served from the app origin with user Content-Type / inline disposition.
5. Review processors (ImageMagick, LibreOffice, ffmpeg, unzip) for known unsafe flags and shelling out.
6. Check authZ: who can upload / overwrite / read whose objects.
7. Confirm size limits, rate limits, and malware scanning expectations for the threat model.

Evidence Requirements

• Upload handler location
• Missing type/size/name controls
• Dangerous serve or process path
• Impact class (RCE / stored XSS / traversal / DoS)

False Positive Controls

• Strict allowlist + random keys + non-executable storage + safe Content-Disposition
• Uploads never served back as active content
• Admin-only internal tooling with compensating network controls (still note residual risk)

Remediation

1. Allowlist extensions and verify content signatures; reject mismatches.
2. Store under random keys outside webroot; never use raw user filenames on disk.
3. Serve via separate domain with Content-Disposition: attachment and fixed safe Content-Type where possible.
4. Process in isolated workers with resource limits; patch converters.
5. Enforce authN/authZ, quotas, and malware scanning for high-risk products.

Verification

Review accept→serve pipeline → Apply allowlist + random keys → Re-run axguard → Confirm no executable serve path

Related Skills

• path-traversal, xss-analysis, command-injection, deserialization-security
• security-triage, security-remediation

Framework Mapping

• CWE-434
• OWASP Top 10 2021 A04:2021 Insecure Design
• OWASP API Security Top 10 2023 API8:2023 Security Misconfiguration

References

• https://owasp.org/Top10/A04_2021-Insecure_Design/
• https://owasp.org/API-Security/editions/2023/en/api8-security-misconfiguration/
• https://cwe.mitre.org/data/definitions/434.html

Research Provenance

Primary sources:

• OWASP Top 10:2021 A04; OWASP API8:2023; CWE-434 (accessed 2026-09-15)

Secondary / internal:

• AXGuard rules/upload.json, /axguard-upload
• AwareXone Agentic-Bug-Hunter upload methodology (concepts only; not copied)

Datasets:

• UVID HF dataset — category linkage concepts only (MIT license metadata review 2026-09-15)