File uploads, polyglots, and storage execution boundaries

Mechanism

Upload vulnerabilities arise when validation, storage, and later consumption disagree about file meaning. Extension, declared media type, magic bytes, and full parser behavior are different signals. A polyglot satisfies more than one format grammar, but impact depends on which component later renders, parses, or executes the file under what identity.

Practical method

Map filename handling, content checks, destination path, retrieval URL, and downstream processors. Start with a harmless accepted file and vary one property. Check whether uploaded content is served from an isolated origin and whether the server executes any stored extension. Inspect conversions and archive extraction separately.

request filename/type -> validator -> stored name -> web handler/parser
                      disagreement must reach a consequential consumer

Interpreting evidence

An accepted unexpected format is not automatically execution. Demonstrate the specific later interpretation using an inert marker and record final filename, response type, and content-disposition behavior.

Pitfalls and limits

Double extensions matter only with matching server rules. Image recompression can remove appended content but may not cover every parser. Race windows can expose files before scanning completes.