Security

Unrestricted File Upload (CWE-434)

Unrestricted file upload is a weakness, catalogued as CWE-434, where an application accepts files of a dangerous type without enough checks on name, content or storage location, letting an attacker store files the server or browser may later execute.

Deep dive

Learn Article

How to Block PHP Execution in Magento Media Folders

Block PHP execution in Magento media folders with nginx and Apache deny rules so uploaded files cannot run as web shells, then verify the 403.

intermediate 5 min read

Back to glossary