Loading story…
Researchers described how weak image-upload controls can let attackers submit files with benign-looking extensions such as .jpg while embedding active content that browsers may execute under the victim site’s origin context. One technique abuses browser content handling with tags such as OBJECT to force interpretation of uploaded content as Flash or other active formats, allowing a malicious file hosted on a trusted site to send authenticated requests with the victim’s cookies and read sensitive responses such as profile data or CSRF tokens. The same class of issue can also support follow-on CSRF-style actions when a logged-in user is lured to an attacker-controlled page.
Separate analysis of web applications using ImageMagick and CarrierWave showed that insecure defaults can widen the exposure by storing uploaded files and temporary cache files in publicly reachable directories, sometimes without reliable access control. The research found that obscure image formats and malformed payloads can trigger browser-side script execution when servers return incorrect or missing Content-Type headers, and that leftover cache files after validation or conversion failures may remain accessible if their URLs are guessable. Recommended defenses include validating file content as well as extensions, restricting accepted formats, serving uploads with correct MIME types, enabling X-Content-Type-Options: nosniff, and moving protected uploads and caches outside public web paths.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A 2018 security blog analyzed how web applications using ImageMagick and CarrierWave could expose uploaded and cached files in public directories, enabling access-control failures, XSS, and cache-file abuse. It also described advanced payload techniques including XV-based script execution and RGB-to-SWF transformations that could support Cross-Site Content Hijacking under certain conditions.
A 2014 blog post introduced a client-side attack technique later named Cross-Site Content Hijacking, showing how a malicious file uploaded with an allowed extension such as .jpg could be forced to load as active content and access authenticated resources on the victim site. The write-up described Flash-based exploitation, data theft of sensitive responses such as user data and CSRF tokens, and noted the naming change from Cross Domain Data Hijacking.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Web applications that process user-uploaded images with **ImageMagick** can expose a broad attack surface when upload controls rely on file extensions or weak type checks. Research describing Rails applications using CarrierWave and MiniMagick showed that attackers may influence both the input and output formats passed to ImageMagick, enabling abuse of vulnerable coders and delegates beyond expected image types. The reports warned that ImageMagick has a long history of flaws including denial of service, memory corruption, and possible code execution, and demonstrated that output formats such as `INFO` and `EPS3` can leak absolute server paths and ImageMagick version details into generated files. The findings align with OWASP guidance on **unrestricted file upload**, which says unsafe upload handling can lead to code execution, information disclosure, client-side attacks, malware hosting, and service disruption. One proof of concept showed that a crafted JPEG of only about 5 KB, with manipulated dimensions of `64250 x 64250`, could drive ImageMagick to allocate roughly **33 GB** of pixel cache and destabilize a host. Recommended defenses included strict allow-listing of formats such as JPEG, GIF, and PNG; validating magic bytes against extensions before processing; enforcing `policy.xml` resource limits and execution timeouts; restricting upload size; using non-executable and isolated storage; sandboxing image processing; limiting concurrency; and keeping ImageMagick updated.
Aug 15, 2026
Multiple web application vulnerabilities have been disclosed, highlighting the risks associated with misconfigured APIs and file upload functionalities. One report demonstrates how a misconfigured GraphQL endpoint, which accepts `application/x-www-form-urlencoded` content types, can be exploited for Cross-Site Request Forgery (CSRF) attacks. Attackers can craft malicious HTML forms to submit GraphQL mutations, such as changing user email addresses, without proper user consent. Another case details a $100 bug bounty awarded for discovering XSS via malicious PDF uploads and input validation bypasses that led to denial-of-service conditions on a coding platform. Further research describes a blind XML External Entity (XXE) vulnerability in a "Check stock" feature, where attackers can trigger out-of-band DNS and HTTP requests using Burp Collaborator, confirming the presence of XXE. Additionally, a $1,500 bounty was awarded for exploiting an image upload feature at Rockstar Games, where a vulnerable ImageMagick instance enabled a chain of attacks including Local File Inclusion (LFI), Server-Side Request Forgery (SSRF), and remote file access via SMB paths. These incidents underscore the importance of strict input validation, secure API configurations, and careful handling of file uploads in web applications.
Jun 29, 2026
Attackers frequently target file upload endpoints in web applications as a means to inject malicious code directly onto servers, often within the webroot, posing significant security risks. Security professionals emphasize the importance of understanding the server environment and web framework before attempting to exploit or defend against file upload vulnerabilities, as the success of an attack often depends on the server's ability to execute the uploaded file. Reconnaissance techniques such as URL path probing and the use of web extension wordlists can help identify the underlying technology, which informs the attacker's choice of payload. Common tools like Burp Suite can automate the process of probing for vulnerable endpoints and extensions. A recent security research effort uncovered a novel technique to bypass file upload restrictions in Outlook Web, revealing that different methods of file insertion—such as attaching a file versus copy-pasting it into the email body—can result in different security outcomes. When an SVG file was attached as an email attachment, Microsoft's server applied security rules and sometimes blocked the upload. However, when the same SVG content was pasted directly into the email body, it was embedded as HTML without any security filtering, allowing potentially malicious content to be rendered on the recipient's side. This discrepancy arises from the use of contentEditable and designMode features in Outlook Web, which permit direct HTML insertion and bypass server-side security checks. The vulnerability is currently being addressed by Microsoft, but it highlights the importance of comprehensive input validation and filtering at all stages of file handling. Attackers exploit such inconsistencies to bypass security controls and deliver malicious payloads, underscoring the need for defense-in-depth strategies. Security teams are advised to review their file upload mechanisms, ensure consistent filtering regardless of the upload method, and monitor for unusual file handling behaviors. The research demonstrates that even well-established platforms like Outlook Web can harbor subtle vulnerabilities that attackers can exploit through creative techniques. Organizations should stay informed about emerging bypass methods and update their security controls accordingly. Regular security assessments and penetration testing are essential to uncover and remediate such weaknesses before they can be exploited in the wild. The evolving landscape of file upload attacks requires continuous vigilance and adaptation of security best practices.
Jun 29, 2026