File Upload Traverser
Summary: PortSwigger lists a Burp Suite extension called File Upload Traverser, version 1.0 and last updated 03 August 2017, that automatically tests whether file uploads are vulnerable to directory traversal and whether uploaded files land in an accessible application directory. It runs as part of Active Scan with no interaction, using one module to upload into directories pulled from the Burp sitemap and another to fuzz for error messages disclosing absolute paths and to query findings from the burp-suite-error-message-checks passive extension.
Why it matters: The extension is described as fairly aggressive in writing files onto the system, and it only creates files named 0157e03014ebcaebb9abf549236dd81c0b0b878d - so cleanup depends on knowing that single filename is scattered across whatever directories the scan could write to.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026