Webroot is the directory on a web server that is exposed to the public internet and serves site content such as HTML, images, scripts, and uploaded files. Anything placed in the webroot can usually be requested directly by a browser, so its contents are part of the site’s attack surface.
In cyber security, webroot matters because a mistake in file handling can turn a normal upload into code execution or a web shell. If an application stores user-supplied files inside the webroot and the server allows script execution there, an attacker may be able to upload a malicious payload and run it as code. Defenders reduce this risk by keeping uploads outside the webroot when possible, blocking execution in upload folders, and applying strict server-side allowlists and permission controls.