Unauthorized file upload is a weakness where an application lets an attacker place a file on a server without proper permission checks or content validation. The uploaded file may be a harmless document, but it can also be a web shell, script, or malicious payload if the server later treats it as executable code. This turns a simple upload form into a possible entry point for remote code execution, defacement, malware hosting, or persistence.
In real attacks, the danger often comes from trusting client-side metadata such as file names, extensions, or MIME types. Secure defenses include authenticating upload actions, validating file content on the server, storing uploads outside the web root, disabling execution in upload directories, and using allowlists for permitted types. Logging upload activity and scanning for unexpected scripts help defenders spot abuse before a planted file is used.