Tested fixes for CWE-434 in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-434: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Common consequences MITRE lists
- Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
An uploaded file that the server executes, or that a browser renders in your origin, becomes a web shell or stored XSS; oversized or crafted files can also exhaust storage or crash parsers.
- Store uploads outside the web root under server-generated names, never the client’s filename.
- Allowlist file types by inspecting content, not only the extension or
Content-Type, and enforce size limits before processing. - Serve user files from a separate domain or with
Content-Disposition: attachmentandX-Content-Type-Options: nosniff. - Process files in an isolated worker and publish them only after inspection succeeds.
Guides on this site
Design a safer file-upload pipeline
Treat upload receipt, content processing, storage, and later delivery as separate security decisions.
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Practice
- Path traversal lab: Serve an uploaded file without path traversal · Browser lab
- File upload lab: Accept avatars without publishing pages · Browser lab
- Keep extracted files inside their boundary · Local project
- Convert untrusted documents in a locked-down container · Local project
References
- CWE-434 in the MITRE CWE list (version 4.20)
- 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program)
- OWASP File Upload Cheat Sheet
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.