Malicious file upload

When it applies

The app accepts a file and later stores, serves, parses, or converts it. Impact depends on what happens to the file after upload — served from webroot? passed to a parser? rendered?

Why it works

Validation is usually on the wrong signal (extension or Content-Type, both attacker-set) while the dangerous behaviour is downstream: the web server executes .php in the uploads dir, a parser follows external entities, or the file is served with an HTML content-type.