File Upload Vulnerabilities
High · File Access
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-434
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-434
Definition
Malicious files uploaded and executed or served.
Root cause
Weak type validation and executable storage.
Affected components
- Components in the “File Access” class
- Application / API handlers
- Supporting libraries
Impact
Remote code execution, stored XSS.
Severity
High
Safe lab reproduction
DVWA File Upload module
Detection methodology
Review upload handlers and storage paths.
Evidence examples
- Lab reproduction notes: DVWA File Upload module
- Request/response excerpts (redacted)
- Detection signal: Review upload handlers and storage paths
Remediation
Validate type, rename, store outside webroot, scan.
Secure coding examples
Store uploads in object storage with no execute permissions.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.