file-upload-vulnerabilities

检测文件上传是否导致远程执行、存储型 XSS 或覆盖等漏洞。

帮你检查任何接受文件上传的位置，看看能不能被利用成远程执行、存储型 XSS、替换重要文件或被当成 web shell。会在有头像、文档导入、附件、导入工具等场景用到，上传入口越多就越需要检测。特别之处在于既测试攻击面能否被利用，又给出分层防护建议（校验、存储策略、权限等），不只是找问题还告诉你怎么安全地接入文件上传。

## Purpose

An upload feature lets a user put a file on your server. Get the validation wrong and that file becomes a web shell, a stored XSS payload, or an overwrite of something important. This skill covers testing the upload surface for those outcomes and the layered controls that make uploads safe.

## When to use it

Any feature that accepts files: avatars, document uploads, import tools, attachments. The worst case — uploading a script that then executes — is why this is a high-severity area worth testing thoroughly.

## Procedure

1. Understand the upload: what types are accepted, where files are stored, and — critically — **is the storage location web-accessible and does it execute c