# Client-controlled upload destination path

Request-supplied filename or path used to build a write target without strict validation

_Area: Web business logic and race conditions. Seen in 3 disclosed reports; one confirmed bounty: $2,400; latest 2026-10-08. Updated 2026-10-31._

## How it works
An upload or write handler takes a filename or path from the request and uses it to build the destination, instead of deriving the destination from a trusted source. The assumption that breaks is that the request-supplied name is just a label; in reality it selects where bytes land. If the target directory holds files the application later parses or executes, the write becomes content injection, not just a stray file.

## Where it shows up
- A POST/JSON field named `filename`, `path` or `name` that overrides the real uploaded name before a copy/move [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md).
- Extension checks that are blocklists of a few types (`.php`, `.htm`, `.js`, `.exe`) rather than allowlists [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md).
- Destination directories containing files the app parses: `.md`, `.yaml`, `.twig`, templates, caches [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md).
- Upload handlers reachable without authentication [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md).

## How to review
Trace the destination from request to write. The invariant: the final path must be built only from server-chosen components (a generated name, a fixed directory), and any user string must be reduced to a safe basename with an allowlisted extension. Check that the directory written to is not one the app later parses or executes. Confirm the extension check is an allowlist, not a short blocklist, and that it covers the file types the target directory consumes [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md).

## Variants seen
- Filename override plus narrow extension blocklist letting a `.md` page file be overwritten [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md).

## Impact and severity
E1 gave unauthenticated content overwrite leading to super-admin account creation. Severity rises when the write target is parsed or executed by the application, and when the handler needs no authentication.

## Adjacent shapes (different root cause, do not anchor this pattern)
- A parser indexing a slice with an unvalidated integer from a separately parsed part, panicking the host process (denial of service) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-mx22-3794-2vpv.md).
- Rename-on-collision and delete-on-error disagreeing on the filename, deleting the wrong file (data loss) [E3](https://bugbountylibrary.com/r/h1%3A1565623.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-w4rc-p66m-x6qq.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-mx22-3794-2vpv.md
- E3: https://bugbountylibrary.com/r/h1%3A1565623.md