# File Upload Vulnerabilities

## Exploitation

When a website has an insecure file upload feature, it almost always ends up in a high severity attacks resulting in RCE.

An attacker can upload any arbitrary file on a machine and then execute the code within that file.

Even if there are WAFs to prevent the upload of certain extensions, they can be bypassed if the whitelist / blacklist is not programmed properly.

These include:

* Including double extensions like `.jpg.php`.
* Null byte truncation `%00`.
* Changing the `Content-Type` header.
* Adding file headers to a malicious file (for example, adding the first 4 bytes of a JPEG file to a PHP file).
* Any combination of these techniques!
