How to Find File Upload Vulnerabilities in Bug Bounty
File upload bugs are popular for a reason. One weak check can turn “profile picture” into stored XSS, XXE, SSRF, or — in the worst cases — remote code execution.
This guide is written for comfortable hunting: clear steps, short sections, and impact that programs understand.
Quick takeaway: Map every upload → learn what the server accepts → bypass extension/MIME checks carefully → ask where the file is served from → escalate only with safe proofs.
Why uploads pay
Uploads sit at a dangerous intersection:
- User-controlled bytes
- Server-side parsing (images, docs, XML, ZIP)
- A later download or render path on a trusted origin
Even when RCE is blocked, SVG XSS or document parsing bugs can still be high impact.
Where to look
- Avatar / KYC document uploads
- Support ticket attachments
- Import CSV / spreadsheet flows
- “Upload from URL” (often SSRF too)
- CMS media libraries
A calm testing checklist
1) Baseline a normal file
Upload a tiny valid image. Note:
- Final URL
Content-Typewhen downloaded- Whether it is
inlineorattachment
2) Probe extension rules
If .php is blocked, labs teach alternatives like double extensions or content-type mismatches. On live programs, stay inside rules and prefer non-destructive proofs.
3) Try polyglots and “weird but valid” formats
- SVG (XSS / XXE angles)
- HTML served as an image type
- Documents that are ZIP+XML under the hood (DOCX/XLSX)
4) Ask the money question
Is the uploaded file:
- Executable by the server?
- Rendered in another user’s browser on your origin?
- Parsed by a dangerous library?
That answer sets severity.
Escalation ideas (ethical)
- SVG stored XSS for session impact
- Upload + path confusion
- Upload-from-URL → SSRF
- Async virus scan race (file briefly reachable before quarantine)
Report shape
- Upload request
- Bypass that mattered
- Where the file is reachable
- Impact demo (XSS alert on a test account, not a webshell on production)
- Fix: allowlist extensions, rewrite filenames, serve from a separate domain, force
Content-Disposition: attachmentfor untrusted types
Original Bugflare article. Practice patterns align with PortSwigger file upload labs. Authorized testing only — avoid destructive shells on production.