Browse / Bypasses / File upload checks

Getting past file upload checks

Extension, content-type and file-content validation. 20 disclosed reports got past one.

1. Webshell via File Upload on ecjobs.starbucks.com.cnOS Command Injection · critical · Starbucks
   688 votes
2. XSS and cache poisoning via upload.twitter.com on ton.twitter.comCross-site Scripting (XSS) - Generic · X / xAI
   198 votes
3. Path traversal in filename in LINE Mac clientPath Traversal · high · LY Corporation
   175 votes
4. Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)Cross-site Scripting (XSS) - Stored · critical · Essity
   48 votes
5. CSRF on cards APICross-Site Request Forgery (CSRF) · X / xAI
   41 votes
6. Bypass extension check leads to stored XSS at https://s2.booth.pmCross-site Scripting (XSS) - Stored · medium · pixiv
   30 votes
7. Arbitrary File delete via PHAR deserializationDeserialization of Untrusted Data · high · Concrete CMS
   28 votes
8. SVG file that HTML Included is able to upload via File ManagerCross-site Scripting (XSS) - Stored · low · Concrete CMS
   26 votes
9. Unrestricted File Upload on https://app.lemlist.comUnrestricted Upload of File with Dangerous Type · medium · lemlist
   24 votes
10. Low privileges (auth) Remote Command Execution - PHP file upload bypass.Code Injection · high · ExpressionEngine
    22 votes
11. Validation bypass for queries generated for PostgreSQLImproper Access Control - Generic · Ruby on Rails
    $1,50021 votes
12. Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injectionOpen Redirect · high · PortSwigger Web Security
    18 votes
13. ReDoS in Rack::Multiparthigh · Ruby on Rails
    18 votes
14. Arbitrary File Download as ShopmanagerPath Traversal · high · Automattic
    15 votes
15. Content-Security Policy bypass with File UploadsImproper Access Control - Generic · high · Rocket.Chat
    14 votes
16. File Upload Restriction BypassClient-Side Enforcement of Server-Side Security · medium · U.S. Dept Of Defense
    10 votes
17. SSRF - pivoting in the private LANServer-Side Request Forgery (SSRF) · low · Concrete CMS
    7 votes
18. Shared file link - password protection bypass under certain conditionsInformation Disclosure · medium · Nextcloud
    $505 votes
19. URI scheme bypass in mail app lead to HTML content spoof and opener controlViolation of Secure Design Principles · Nextcloud
    5 votes
20. Flash Cross Domain Policy Bypass by Using File Upload and Redirection - only in ChromeOpen Redirect · Internet Bug Bounty
    3 votes