File Upload Vulnerabilities
High · File Access · CWE-434
Description
Malicious files uploaded and executed or served.
Root cause
Weak type validation and executable storage.
Impact
Remote code execution, stored XSS.
Detection
Review upload handlers and storage paths.
Mitigation
Validate type, rename, store outside webroot, scan.
Secure coding
Store uploads in object storage with no execute permissions.
Safe lab example
DVWA File Upload module
Practise related skills in Labs or deepen on Academy library.