> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/web-pentesting/web-vulnerabilities/server-side/file-upload.md).

# File Upload

## Theory

File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficient validation. We may leverage this vulnerability to upload executable code (i.e. php, aspx, jsp ...) and execute it by accessing it.

## Practice

## Resources

{% embed url="<https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload>" %}

{% embed url="<https://portswigger.net/web-security/file-upload>" %}