# Sast Fileupload

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach...

- Repository: https://github.com/utkusen/sast-skills (1357 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-23
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add utkusen/sast-skills --skill sast-fileupload -g -a claude-code -y`
Codex: `npx skills add utkusen/sast-skills --skill sast-fileupload -g -a codex -y`
Cursor: `npx skills add utkusen/sast-skills --skill sast-fileupload -g -a cursor -y`
Gemini CLI: `npx skills add utkusen/sast-skills --skill sast-fileupload -g -a gemini-cli -y`

## Description

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/fileupload-results.md. Use when asked to find file upload, unrestricted upload, or extension bypass bugs.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Insecure File Upload Detection

You are performing a focused security assessment to find insecure file upload vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: **discovery** (find all places where uploaded files are received and stored), **batched verify** (check bypass vectors in parallel batches of up to 3 upload sites each), and **merge** (consolidate batch reports into one results file).

**Prerequisites**: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.

---

## What is an Insecure File Upload

Insecure file upload occurs when an application accepts files from users without properly validating or restricting what can be uploaded, allowing an attacker to upload executable or malicious files. The most critical outcome is **Remote Code Execution (RCE)**: an attacker uploads a web shell (e.g., a `.php` file) and the server executes it when accessed via a direct URL.

The core pattern: *a user-supplied file reaches a storage location without adequate extension validation, and the stored file is accessible or executable.*

### What Insecure File Upload IS

The rest: https://github.com/utkusen/sast-skills/blob/HEAD/sast-files/.agents/skills/sast-fileupload/SKILL.md