Curated security research, vulnerabilities, advisories and tools for practitioners.

#file-upload

Security coverage tagged file-upload.

1.

CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoC

vulnerability | Critical | 2026-09-05 06:23 | CVE-2026-32475 | github.com | Original ↗ | .md | #bug-bounty | #rce | #wordpress

2.

CVE-2026-15748 — WPMU DEV Forminator Forms Select Field Injection Unrestricted File Upload

research | 2026-08-18 00:00 | CVE-2026-15748 | aretiq.ai | Original ↗ | .md | #ai-security | #rce | #wordpress

3.

CivetWeb: PUT + SSI = RCE.

research | 2026-07-01 00:00 | bugpwn.com | Original ↗ | .md | #rce | #vulnerability-research | #web-security

4.

ImageMagick: From Arbitrary File Read to File Write In Every Policy

blog | 2026-03-30 07:06 | pwn.ai | Original ↗ | .md | #ai-security | #rce | #zero-day

5.

[EN] Deep Looking into Centreon

vulnerability | 2026-03-06 20:49 | CVE-2026-2749 | yokai.hakaisecurity.io | Original ↗ | .md | #rce | #vulnerability-research | #sql-injection

6.

14 Vulnerabilities in broadcasting system used by The United Nations, BBC Radio and others

blog | 2025-11-26 00:00 | abdulmhsblog.com | Original ↗ | .md | #vulnerability-research | #path-traversal | #reverse-engineering

7.

Anatomy of an Automated Patch: Fixing a File Upload RCE CVE-2025-59304

vulnerability | Critical | 2025-11-06 00:00 | CVE-2025-59304 | depthfirst.com | Original ↗ | .md | #rce | #path-traversal | #automated-patching

8.

Abusing libmagic﹕ Inconsistencies That Lead to Type Confusion

research | 2025-10-06 00:00 | lab.ctbb.show | Original ↗ | .md | #exploitation | #type-confusion | #file-upload

9.

Vulnerability Deep Dive: Gaining RCE Through ImageMagick With Frans Rosen

vulnerability | 2024-10-17 20:36 | hackerone.com | Original ↗ | .md | #rce | #case-study | #hackerone

10.

Avoiding unrestricted file upload - straight to the source

research | 2024-07-12 13:00 | yokai.hakaisecurity.io | Original ↗ | .md | #vulnerability-research | #file-upload | #insights

11.

OsCommerce v4 RCE: Unveiling the file upload bypass threat

vulnerability | 2024-06-03 17:09 | CVE-2024-22724 | yokai.hakaisecurity.io | Original ↗ | .md | #rce | #vulnerability-research | #research

12.

Secure File Uploads in Flask: Filtering and Validation Techniques

incident | 2024-03-18 03:00 | hackerone.com | Original ↗ | .md | #web-security | #python | #best-practices

13.

Handling Large File Uploads in React: Securely Using AWS S3 Pre-signed URLs

blog | 2024-01-11 02:33 | hackerone.com | Original ↗ | .md | #cloud | #cloud-security | #aws

14.

TaskCafe, Version 0.3.2 Advisory

blog | 2023-06-20 00:00 | bishopfox.com | Original ↗ | .md | #access-control | #account-takeover | #xss

15.

File Upload Attacks (Part 2)

blog | 2021-06-16 15:18 | yeswehack.com | Original ↗ | .md | #bug-bounty | #rce | #web-security

16.

File Upload Attacks (Part 1)

blog | 2021-05-12 15:22 | yeswehack.com | Original ↗ | .md | #bug-bounty | #rce | #denial-of-service

17.

OpenClinic Version 0.8.2 Advisory

blog | 2020-12-01 00:00 | CVE-2020-28937 | bishopfox.com | Original ↗ | .md | #rce | #advisory | #file-upload

18.

Solismed Version 3.3SP1

blog | 2019-12-09 00:00 | bishopfox.com | Original ↗ | .md | #rce | #advisory | #healthcare

19.

Improvements to File Attachments

vulnerability | 2016-03-19 00:00 | bugcrowd.com | Original ↗ | .md | #bugcrowd | #platform-update | #vulnerability-reporting

20.

Executing MSF Payloads via PowerShell Webshellery

blog | 2014-04-14 00:00 | netspi.com | Original ↗ | .md | #windows | #powershell | #metasploit

21.

Adding PowerShell to Web Shells to get Database Access

blog | 2013-04-22 00:00 | netspi.com | Original ↗ | .md | #powershell | #file-upload | #mssql

22.

Vulnerability Alert: FCKeditor Arbitrary File Upload

blog | 2009-12-09 00:00 | netspi.com | Original ↗ | .md | #web-security | #exploitation | #vulnerability