| Title | MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df Unrestricted Upload |
|---|
| Description | The affected component is the `store()` method of `app/Http/Controllers/FileController.php`. The only validation applied to the uploaded file is size and presence; no extension allowlist, MIME-type restriction, or content inspection exists:
```php
$request->validate([
'file' => 'required|file|max:10240', // 10MB max
]);
$path = $request->file('file')->store('files', 'public');
```
Files are stored under `storage/app/public/files/` and served back by the `/storage/{filename}` route (`routes/web.php`) at the application origin. Any content type can be uploaded: HTML/JavaScript documents, SVGs with scripts, executables, malware. The stored filename keeps the extension for MIME types the framework can map (e.g. `.html`, `.svg`, `.js`), which allows hosting active content and phishing/malware pages on the application's own domain, and unlimited uploads allow filling the server disk.
|
|---|
| Source | ⚠️ https://github.com/MomoTommy/file-management-system/issues/2 |
|---|
| User | Yangnb1234 (UID 101983) |
|---|
| Submission | 10/07/2026 16:18 (25 days ago) |
|---|
| Moderation | 10/21/2026 08:55 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424694 [file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df FileController.php store file unrestricted upload] |
|---|
| Points | 20 |
|---|