Prevent Unrestricted File Upload in Symfony Apps

Unrestricted File Upload is a high-risk web vulnerability that allows attackers to upload malicious files such as PHP shells, JavaScript payloads, or ransomware. In Symfony-based applications, improper file validation can make your entire server vulnerable to exploitation.

In this post, we’ll explore how unrestricted file uploads can be exploited in Symfony, how to prevent them using secure coding practices, and how you can scan your site for free with our free Website Security Scanner tool.

🔗 Also check out our Pentest Testing Blog for more cybersecurity tutorials.

⚠️ What is Unrestricted File Upload?

An unrestricted file upload vulnerability occurs when a web application accepts files from users without properly validating:

• File type

• File extension

• File size

• MIME type

• Upload destination
  
  

In Symfony apps, if file uploads aren't restricted correctly, attackers could upload backdoors or scripts and execute them on your server.

💣 Real-Life Threat Example

A hacker could upload a .php web shell and access it through a browser, giving them remote access to your system:

// Example of a malicious PHP web shell

<?php

if(isset($_REQUEST['cmd'])){

  echo "<pre>";

  $cmd = ($_REQUEST['cmd']);

  system($cmd);

  echo "</pre>";

  die;

}

?>

Once this file is uploaded to your Symfony app and accessed via the browser, attackers can run any system command on your server.

🔐 How to Secure File Upload in Symfony

Here’s how you can secure file uploads in Symfony with practical code examples:

✅ 1. Limit Allowed File Types

Use Symfony’s built-in file validation using annotations or YAML/XML config to restrict MIME types and extensions.

use Symfony\Component\Validator\Constraints as Assert;

class UploadFile

{

    /**

     * @Assert\File(

     *     maxSize = "1024k",

     *     mimeTypes = {"image/jpeg", "image/png"},

     *     mimeTypesMessage = "Please upload a valid image file"

     * )

     */

    private $file;

}

✅ 2. Validate File Extensions

Use PHP’s pathinfo() to reject unexpected extensions.

$allowedExt = ['jpg', 'png', 'pdf'];

$ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);

if (!in_array(strtolower($ext), $allowedExt)) {

    throw new \Exception('Invalid file type.');

}

✅ 3. Rename Uploaded Files

To prevent execution of malicious files, always rename files on upload and store them outside the web root.

$newFileName = uniqid().'.'.$ext;

move_uploaded_file($_FILES['file']['tmp_name'], '/var/uploads/'.$newFileName);

📷 Free Security Scanner Screenshot

📸 Screenshot of the webpage of our Website Vulnerability Scanner tool 

Screenshot of the free tools webpage where you can access security assessment tools.