All Security Checks
Vulnerability DetectionA01:2021A10:2021

File Upload Security Scanner

Test file upload endpoints for unrestricted uploads and remote code execution risks.

Unrestricted file upload is a critical vulnerability that can lead to remote code execution. Our scanner identifies file upload endpoints and tests for dangerous file type acceptance, missing content-type validation, path traversal, and file size limits.

What This Scanner Does

Discovers file upload forms and endpoints across all crawled pages. Tests for acceptance of dangerous file types (.php, .jsp, .exe), missing MIME-type validation, file size limit enforcement, and path traversal in filenames.

Why It Matters

An unrestricted file upload can let attackers upload web shells, gaining full control of your server. Even with execution prevention, uploaded files can be used for stored XSS, phishing, or serving malware from your domain.

Common Findings

  • No file type restriction on upload endpoint
  • MIME type not validated server-side
  • Uploaded files accessible via direct URL
  • Missing file size limits

OWASP Top 10 Coverage

A01:2021Broken Access Control
A10:2021Server-Side Request Forgery (SSRF)

Run This Check on Your Site

Get a full security report with AI-powered fix suggestions in 30 seconds. No setup required.

Related Security Checks