Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request?

For example


Content-Disposition: form-data; name="hello.pdf"; filename="..\..\..\..\license.rtf"
  • 3
    yes it makes absolute sense – yeah_well Mar 11 at 8:59

It depends entirely on how your program handles filenames. However, path traversal isn't done with encoding, you actually have to check which directory your file is getting written into.


I would also try single quotes in the file name, you never know you'll find a SQL injection if the filename is inserted into a DB without sufficient sanitization.

Notes from MDN:

The string following filename should always be put into quotes; but, for compatibility reasons, many browsers try to parse unquoted names that contain spaces.

You might also try to spoof the MIME type (Content-Type) in case the underlying application is relying on it rather than check the file extension (although this is unlikely).

Perhaps try a very large file name, like 255+ characters and see what happens.

PS: In this example name should be the HTML form field name, I doubt it would be called hello.pdf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.