Collected research

Persistent PHP payloads in PNGs: How to inject PHP code in an image

Persistent PHP payloads in PNGs: How to inject PHP code in an image –

Quentin Roland · Synacktiv

PHP code can be hidden inside valid PNG files so it survives server-side image processing: in a comment or appended raw, in the critical PLTE chunk to survive PHP-GD compression, in IDAT pixel data to survive resizing, or in a non-Comment tEXt chunk to survive Imagick. Where a server can be made to interpret the image as PHP, this yields remote code execution.

Record

Document

Persistent PHP payloads in PNGs: How to inject PHP code in an image –

Researcher

Quentin Roland

Published by

Synacktiv

Topic

Server

In the archive

• Collected in the 2022 research round

Related sources

• Research demonstration application

Tags

• file-upload
• rce
• php
• filter-bypass
• mime
• lfi
• injection
• case-study
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Quentin Roland, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.