To test file upload security, try uploading files the app should refuse: wrong extensions, double extensions, a mismatched content type, oversized files and compressed bombs. Then check where accepted files are stored, how they are named and whether they can be fetched and executed. Always test on staging.
What can go wrong
An upload feature takes attacker-controlled bytes and a filename. Weak handling can lead to stored scripts, overwritten files, malware distribution or denial of service. OWASP's file upload guidance lists the main defenses: extension allowlists, checking the real file type rather than the declared one, random server-side names, safe storage, size limits and malware scanning.
Test cases
| Test | What you upload | Expected |
|---|---|---|
| Disallowed extension | A script file | Rejected |
| Double extension | Name ending in an image extension after a script one | Rejected |
| Content type mismatch | Script bytes with an image content type | Rejected |
| Oversized file | Above the stated limit | Rejected with a clean error |
| Path in filename | Name with directory traversal text | Name replaced |
| Image with metadata | Photo with location data | Metadata stripped if promised |
| Archive with large expansion | Small zip that expands hugely | Size checked after expansion |
| Anonymous upload | No session | Rejected |
Steps
- List every upload feature, including avatars, imports and attachments.
- For each, upload one valid file and note the stored name and URL.
- Run the table's negative cases and record what was accepted.
- Fetch the stored file directly. Check it is served with a safe content type and cannot run as code.
- Check that the stored name is random and unrelated to your original filename.
- Confirm uploads sit on a separate host or outside the web root, as the cheat sheet advises.
- Confirm the endpoint requires a signed in user and protects against cross-site request forgery.
Fix direction
Allowlist what the business needs, rename on the server, validate the real type, cap sizes, scan for malware, and serve uploaded content from a domain that cannot touch your session cookies.
Quick check
Is checking the extension enough?
No. Extensions and declared content types are attacker controlled. Validate the real content as well.
Where should uploaded files live?
Prefer a separate host. If not possible, store them outside the web root, as OWASP advises.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
