Collected research

Image Names Gone Bad

Image Names Gone Bad ha.ckers.org web application security lab

Uploaded image filenames become XSS vectors where the name is re-emitted into HTML or JavaScript: one breaks out of an img tag with a script element, two more close a quote to land in script context. FreeBSD accepts such names where Windows will not. A dropped RSnake comment adds a high-bit US-ASCII variant.

Record

Document

Image Names Gone Bad ha.ckers.org web application security lab

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2007 research round

Tags

• file-upload
• xss
• filter-bypass
• injection
• encoding
• sanitizer-bypass
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 17 August 2026.