file-upload-and-traversal

name	file-upload-and-traversal
description	Path traversal encodings, the file-upload bypass matrix (extension/MIME/magic-byte checks), and file-format-specific attacks (SVG/DOCX/XLSX XXE, PDF launch actions, polyglot images). Converted from master-pentest-prompt.md Phase 6. Use on any file-upload feature or any endpoint that takes a file path/name as input.

File upload & traversal

When to use

Any upload feature (avatar, document, import), and any endpoint that builds a file path from user input (download-by-filename, template selection, log viewers).

Path traversal

All encodings: ..%2f, %252e%252e, //, dot-bypass variants. File write via traversal (overwrite a config file to get RCE) is a strictly higher-impact variant of file read -- always check whether an upload or export feature that accepts a path/filename can be steered to write outside the intended directory, not just read outside it.

Upload bypass matrix

• Extension whitelist bypass, MIME-type sniff bypass, magic-byte bypass.
• Double extension (shell.php.jpg), null byte, Unicode tricks, case swap (shell.PHP).
• .phtml/.php5/.phar and other executable-adjacent extensions the whitelist might miss.

File-format-specific attacks

• SVG + XXE, DOCX/XLSX XXE (Office Open XML formats embed XML internally).
• PDF JS/launch actions.
• ImageTragick, polyglot JPEG/PNG/WebP with an embedded PHP payload.
• EXIF data with a payload, ZIP archive symlink tricks.