Do filenames themselves pose a security risk?

We have a webserver, users can upload files to the server. The files are temporarily stored on the server, then moved to S3. The filenames are recorded into our MySQL database and eventually included in the HTML & CSS that our webserver produces. The filenames themselves are never changed from what the user uploads.

In terms of security, is there any vulnerability that can be exploited with a mere filename? Should we be changing the filenames of uploaded content, or is it safe to simply store the filenames as they are?

closed as too broad by Steffen Ullrich, S.L. Barth, Xander, Jeroen - IT Nerdbox, LvB Jun 13 '18 at 11:56

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    A mere filename poses no risk. But if your code makes decisions or actions based on invalid assumptions about the filename (like parsing the name, processing based on file extension ...) or if it is possible to include the file as code into your own code (i.e. insecure include path for PHP) then it might be a risk. Only, nothing is known about your code and server setup so this question cannot be answered. – Steffen Ullrich Jun 7 '18 at 10:24
  • 2
    Only thing I can think of is overwriting files which could tamper with the integrity of existing files. – Jeroen - IT Nerdbox Jun 7 '18 at 10:25
  • 1
    You can certainly exploit using various unsupported characters. The actual name is not the problem. There's a problem when you start to process it with something. – Overmind Jun 7 '18 at 10:32
  • 2
    If they're going into an SQL database the filename could be an SQL injection attempt – Joss Bird Jun 7 '18 at 10:51
  • 4
    @Jimmery: Again, the name by itself poses no risk. The risk is in what you are doing with the name, which means your code, your system setup etc. Only, nothing is known about how the name gets used by these. – Steffen Ullrich Jun 7 '18 at 12:36

Yes, all user controlled input poses a potential security risk and should never be trusted.

But, if the file name is a threat to your application depends on how you process the file and the file name internally. I would suggest to sanitize the file name when the user executes the file upload.

For test cases, best practices and prevention methods see the Unrestricted File Upload page at OWASP.

  • It's not possible to sanitize it as you don't know where it will be used. – FINDarkside Jun 7 '18 at 12:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.