File upload bugs are still everywhere. My 2026 playbook:
1. Map every upload — profile pic, resume, CSV, KYC, support attachments. Different code paths, different bugs.
2. Beat the extension filter:
- shell.PHP (case)
- shell.php.jpg / shell.jpg.php
- .phtml .php5 .phar .pht
- null byte
- shell.php;.jpg (IIS)
3. Spoof Content-Type: image/jpeg in Burp. Half the time it's the only check.
4. Beat magic bytes — prepend GIF89a; to your PHP. Valid image header, valid PHP.
5. SVG = XML = <script>. Stored XSS via image view. Bonus: XXE via DOCTYPE.
6. Path traversal in filenames Zip Slip in ZIP uploads.
7. Look at what processes the file after upload — ImageMagick, FFmpeg, headless Chrome PDF renderers. SSRF LFI hide there.
8. Race the antivirus — upload, hammer the URL before the scanner deletes.
9. Trap: hunters test the obvious field and leave. Real bugs live in admin/import/bulk uploads no one tests.
10. Report on IMPACT not the upload. ".phtml uploaded" = medium. ".phtml RCE PoC at /uploads/" = critical.
What's the wildest upload bug you've found?