CVE-2017-12615

Summary

Unrestricted file upload occurs when an application accepts an uploaded file without validating its type or content and stores it inside a web-accessible directory where the server will execute it, letting an attacker upload a script such as a .php or .jsp webshell and request it to run arbitrary code as the web user. At the code level the flaw is trusting client-supplied data (the filename extension or the Content-Type header) instead of verifying actual content, and saving to an executable path; weak filters are also bypassable, for example a regex without an anchoring $ or extension checks that ignore trailing characters. CVE-2017-12615 (disclosed 19 September 2017) is a documented case: Apache Tomcat 7.0.0 to 7.0.79 on Windows with the Default servlet's readonly parameter set to false allowed HTTP PUT uploads, and appending a trailing slash like shell.jsp/ bypassed the extension check, writing a JSP that Tomcat then executed for full remote code execution. This class maps to OWASP A04:2021 Insecure Design and overlaps A05 Security Misconfiguration; CWE-434.

Severity

critical

EPSS

99.6% (p100)

CWE

CWE-434

Also known as

APPSEC-FILE-UPLOAD, Unrestricted File Upload, Webshell Upload

Published

2017-09-19

How to avoid it

• Validate file content by magic bytes and a strict allow-list of extensions, not the client-supplied Content-Type or name.
• Store uploads outside the web root or in object storage and serve them via a handler that never executes them.
• Generate server-side random filenames and disable script execution in the upload directory.
• Disable HTTP PUT and the writable Default servlet (readonly=true) on application servers.
• Enforce size limits and scan content; reject double extensions, trailing slashes, and null bytes.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-12615
• https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
• https://owasp.org/Top10/2021/A04_2021-Insecure_Design/

Related advisories

• CVE-2026-63223 — critical · Packagist/codeigniter4/framework
• GHSA-hgjx-r89m-m7v4 — critical · Packagist/facturascripts/facturascripts
• CVE-2026-50006 — critical · Go/github.com/julien040/anyquery
• CVE-2026-53649 — critical · Go/github.com/BishopFox/joro
• GHSA-qxvg-h7q2-hcxh — critical · PyPI/motioneye
• CVE-2026-81891 — high · Packagist/Studio-42/elFinder
• GHSA-ghvf-qf6h-g8x5 — high · npm/@nocobase/server
• CVE-2026-53599 — high · Packagist/redaxo/source

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity