AI LOAD INSTRUCTION: Expert file upload attack playbook. Use when the target accepts files, imports, avatars, media, documents, or archives and you need the full workflow: validation bypass, storage path abuse, post-upload access, parser exploitation, multi-tenant overwrite, and chaining into XSS, XXE, CMDi, traversal, or business logic impact. For web server parsing vulnerabilities, PUT method exploitation, and specific CVEs (WebLogic, Flink, Tomcat), load the companion SCENARIOS.md.

• IIS parsing vulnerabilities —

  x.asp/

  directory parsing,

  ;

  semicolon truncation (

  shell.asp;.jpg

  )
• Nginx parsing misconfiguration —

  avatar.jpg/.php

  with

  cgi.fix_pathinfo=1

• Apache parsing — multiple extensions,

  AddHandler

  , CVE-2017-15715

  \n

  (0x0A) bypass
• PUT method exploitation — IIS WebDAV PUT+COPY, Tomcat CVE-2017-12615

  readonly

  +

  .jsp/

  bypass
• WebLogic CVE-2018-2894 arbitrary file upload via Web Service Test Page
• Apache Flink CVE-2020-17518 file upload with path traversal
• Upload + parsing vulnerability chain — EXIF PHP code + Nginx

  /.php

  path info
• Full extension bypass reference table (PHP/ASP/JSP alternatives, case variations, null bytes)

• path traversal lfi when filename, extraction path, or include path becomes file-system control
• xss cross site scripting when uploads are rendered in browser contexts
• xxe xml external entity when SVG, OOXML, or XML imports are accepted
• cmdi command injection when a processor, converter, or media pipeline executes system tools
• business logic vulnerabilities when quotas, overwrite rules, approvals, or storage paths create logic bugs

1. Accept: what validation happens before the file is stored?
2. Store: where is the file written and under what name and permissions?
3. Process: what background tools, converters, scanners, parsers, or extractors touch it?
4. Serve: how is it later downloaded, rendered, transformed, or shared?

• Which extensions are allowed, denied, or normalized?
• Does the backend trust extension, MIME type, magic bytes, or all three?
• Is the file renamed, transcoded, unzipped, scanned, or re-hosted?
• Is retrieval direct, proxied, signed, or served from a CDN?
• Can one user predict or overwrite another user's file path?
• Do filenames, metadata, or previews reflect back into HTML, logs, admin consoles, or PDFs?

/uploads/USER_ID/avatar.png
/files/org-slug/report.pdf
/cdn/tmp/<uuid>/<filename>

• cross-tenant read by guessing IDs, slugs, or UUID patterns
• overwrite by reusing another user's filename
• path normalization bugs in filename or archive members
• private file exposed through direct object URL despite UI-level access control

• gallery HTML
• admin moderation panels
• PDF/CSV export jobs
• logs, audit views, or email notifications

1. The file is touched by a processor.
2. The processor behaves differently from the upload validator.
3. That difference creates impact: read, execute, overwrite, SSRF, or stored client-side execution.

• SVG served as active content
• HTML or text uploads rendered inline
• EXIF or filename reflected into an HTML page

• SVG XXE for file read or SSRF
• OOXML import for XML entity or parser abuse
• CSV import for formula execution in analyst workflows

• image or document converter invoking shell tools
• zip slip writing outside intended directory
• upload-to-LFI chain where uploaded content later becomes includable

• private upload accessible via predictable URL
• moderation or quarantine path still publicly reachable
• one user replacing another user's public asset

• upload quota enforced in UI but not API
• plan restrictions checked on upload page but not on import endpoint
• file ownership checked on list view but not on direct download or replace endpoint
• approval workflow bypassed by calling the final storage endpoint directly
• delete or replace action missing object-level authorization

1. Upload one benign marker file and map rename, path, and retrieval behavior.
2. Try one validation-bypass sample and one active-content sample.
3. Check whether retrieval is attachment, inline render, transformed preview, or background processing.
4. If processing exists, pivot by processor family: XSS, XXE, CMDi, zip slip, or SSRF.
5. Run tenant-boundary and overwrite tests on file IDs, replace endpoints, and public URLs.

P(RCE via Upload) = P(bypass_detection) × P(obtain_path) × P(execute_via_webserver)

• Path discovery: Without knowing the upload path, even a successful bypass is useless
• Server parsing: Even with a

  .php

  file uploaded, if the web server doesn't parse it as PHP, no RCE