PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to another one, since the /tmp permission is 777.

OWASP has nothing listed in the security recommendations. Should I really worry about changing this folder to another one or there are no risks?

  • 2
    Technically the /tmp directory permission is 1777; the sticky bit being set to protect users' files from other users. That does offer some mitigation against the sort of attacks that might concern you. – gowenfawr Jun 7 at 14:58
  • Moreover, systemd is probably configured to give the web server (since you are talking about uploading files) its own local /tmp – Ángel Jun 7 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.