#vulns.co
/
mcp by GKData.io

← Back to Gadgets

File upload gadget

Content-Type vs magic-byte vs extension vs Content-Disposition. Polyglots (GIFAR, HTML-in-PDF, SVG, HTML-in-PNG) are the inventory.

Tags: upload, xss, rce

Typical severity: P2-P4

What it becomes

XSS if it is served as HTML/SVG from a cookie domain. RCE if the server parses it (ImageMagick, LibreOffice, FFMpeg, unzip). ATO if it overwrites an avatar consumed as HTML.

Where to look

  • avatars
  • ticket attachments
  • CSV import
  • theme zip
  • SCORM / course upload
  • email attachments re-served

Chains

  • Stored XSS — SVG or HTML served from the app origin or a cookied CDN.
  • RCE — Zip slip, ImageMagick, Office macros on a backend converter, template upload.

Notes

  • A separate file origin (S3 with content-disposition attachment) kills XSS. Check cookies and CSP on that origin before reporting.
  • Do not upload real malware. Use inert markers.

← Back to Gadgets