# Inline-served uploads execute as active content

Uploads served inline with attacker-controlled type, sniffable or scriptable (SVG/HTML) on the app origin

_Area: Web injection and code execution. Seen in 5 disclosed reports; 3 confirmed bounties, median $1,000, range $500-$3,000; latest 2020-09-01. Updated 2026-10-23._

## How it works
An upload is treated as inert data, but the serving path hands it back to the browser as active content. The assumption that breaks: that the stored file's type and disposition are safe. When the server sets `Content-Disposition: inline` (or omits it), echoes the blob's own content type, or sends no `Content-Type` at all, the browser renders the file in the application origin. An SVG or HTML payload then runs script with that origin's cookies and DOM access. The same flaw appears when a sanitizer or allowlist is bypassed so scriptable markup survives, or when a CDN/object store accepts writes and serves them as script.

## Where it shows up
- File-serving controllers that derive `Content-Disposition`/`Content-Type` from the blob rather than a fixed safe value [E1](https://bugbountylibrary.com/r/h1%3A949513.md).
- Proxy/streaming endpoints that pass through the original content type [E1](https://bugbountylibrary.com/r/h1%3A949513.md).
- Responses with blank or `application/octet-stream` type, or no `Content-Type`, on user uploads [E2](https://bugbountylibrary.com/r/h1%3A452559.md)[E3](https://bugbountylibrary.com/r/h1%3A84601.md).
- Extension blocklists that reject known-bad types but pass unknown ones [E3](https://bugbountylibrary.com/r/h1%3A84601.md).
- SVG sanitizers/allowlists that can be short-circuited by XML entities or malformed markup [E4](https://bugbountylibrary.com/r/h1%3A299424.md).
- Host-based redirect allowlists pointing at a domain that also hosts user-uploaded SVG/HTML [E5](https://bugbountylibrary.com/r/h1%3A104087.md).
- CDN write endpoints whose auth depends on the request `Content-Type` [E2](https://bugbountylibrary.com/r/h1%3A452559.md).

## How to review
The invariant: any user-controlled bytes must never be served with a type the browser will execute, in an origin that holds session or trust. Check that serving code forces a safe `Content-Type` (e.g. `application/octet-stream` or a fixed image type) and `Content-Disposition: attachment` for anything not provably inert, independent of the stored blob type and of any request parameter [E1](https://bugbountylibrary.com/r/h1%3A949513.md). Confirm no path returns a blank/absent type that invites sniffing, and that `X-Content-Type-Options: nosniff` and CSP apply to upload responses [E1](https://bugbountylibrary.com/r/h1%3A949513.md)[E3](https://bugbountylibrary.com/r/h1%3A84601.md). For sanitizers, verify the allowlist is enforced after full XML parsing, including entity expansion [E4](https://bugbountylibrary.com/r/h1%3A299424.md). For redirects, confirm no allowed host serves attacker-controlled scriptable content [E5](https://bugbountylibrary.com/r/h1%3A104087.md). For CDN writes, confirm auth does not vary with `Content-Type` [E2](https://bugbountylibrary.com/r/h1%3A452559.md).

## Variants seen
- Framework proxy serving SVG inline with attacker-influenced disposition [E1](https://bugbountylibrary.com/r/h1%3A949513.md).
- CDN object-store write bypass via blank/octet-stream type, then stored XSS [E2](https://bugbountylibrary.com/r/h1%3A452559.md).
- Unknown extension accepted, served without type, browser-sniffed to HTML [E3](https://bugbountylibrary.com/r/h1%3A84601.md).
- SVG sanitizer bypass via XML entity [E4](https://bugbountylibrary.com/r/h1%3A299424.md).
- Same-domain uploaded SVG used to reopen a fixed open redirect [E5](https://bugbountylibrary.com/r/h1%3A104087.md).

## Impact and severity
Stored XSS in the app origin, affecting all customers in some cases [E2](https://bugbountylibrary.com/r/h1%3A452559.md)[E4](https://bugbountylibrary.com/r/h1%3A299424.md), session/data theft, cache and AppCache poisoning [E3](https://bugbountylibrary.com/r/h1%3A84601.md), and re-opened redirects [E5](https://bugbountylibrary.com/r/h1%3A104087.md). Severity rises when the origin is shared across tenants or trusted by other apps, and when no CSP or nosniff limits execution.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A949513.md
- E2: https://bugbountylibrary.com/r/h1%3A452559.md
- E3: https://bugbountylibrary.com/r/h1%3A84601.md
- E4: https://bugbountylibrary.com/r/h1%3A299424.md
- E5: https://bugbountylibrary.com/r/h1%3A104087.md