File Upload Vulnerabilities

File upload vulnerabilities occur when websites or applications allow users to upload files without adequate security measures. Attackers exploit these weaknesses to upload malicious files, potentially leading to issues like remote code execution, bypassing file type restrictions, content-type manipulation, file overwriting, or denial of service attacks.

Example

A critical vulnerability in the Forminator WordPress Contact Form plugin, affecting over 400,000 websites, allows unauthenticated attackers to upload malicious files, potentially leading to remote code execution. The issue has been patched in version 1.25.0, and users are urged to update immediately for security. The vulnerability highlights the need to secure contact forms, and the Forminator changelog should provide information on the patch.

Cards

Data-validation-&-encoding

Authorization

Github logo View source on GitHub

OWASP Cornucopia

  • OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams identify security requirements in Agile, conventional and formal development processes. It is language, platform and technology-agnostic, and is free to use.
  • OWASP Cornucopia is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar licence to this one.
  • © 2012-2025 OWASP Foundation. The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.

OWASP and the OWASP logo are trademarks of the OWASP Foundation

Last update was Fri, 31 Jan 2025 15:30:18 GMT

Licensing information | Acknowledgements | Q & A | Roadmap

© OWASP Foundation 2025 rss | Sitemap