Glossary
Unrestricted file upload
A vulnerability class where an application stores uploaded files without ensuring they cannot be executed by the server.
Unrestricted file upload is a vulnerability class (CWE-434) in which an application accepts uploaded files without adequately restricting their type, name or storage location, allowing an attacker to upload content the server will execute — a direct path to a web shell.
Robust mitigations are architectural: store uploads outside the webroot or in object storage, allow-list types and validate content server-side, rename files to random identifiers, and configure upload directories so the server never executes scripts there. See how web shells get planted.