vetkit.php.file-upload.client-filename
An uploaded file is stored under a name or extension chosen by the client. Without an extension allow-list this allows uploading executable .php files or overwriting files.
Last updated:
Suite: Security
php
An uploaded file is stored under a name or extension chosen by the client. Without an extension allow-list this allows uploading executable .php files or overwriting files.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Generate the stored file name server-side (random id + an extension from an allow-list, e.g. Laravel's hashName()), store uploads outside the web root and never execute them.
References
Source: packages/engine/rules/sast/php.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.