Collected research

Arbitrary File Upload Tricks In Java

pyn3rd · pyn3rd.github.io · 7 May 2022

Filename normalisation differs across Java upload paths: getSubmittedFileName drops backslashes, Spring StringUtils.cleanPath collapses slash-dot sequences, and commons-io FilenameUtils.getName treats a trailing slash or space specially. A filename that passes an extension or WAF check is therefore written to disk as an executable JSP.

Record

Researcher

pyn3rd

Published by

pyn3rd.github.io

Date

7 May 2022

Topic

Server

In the archive

• Collected in the 2022 research round

Tags

• file-upload
• filter-bypass
• parser-differential
• waf-bypass
• path-traversal
• java
• spring
• rce
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of pyn3rd, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.