File upload on a form: resumes and images that should not run

A vacancy, a complaint, a receipt upload, an avatar in the account area. The business needs the file. The mistake is the same: it is saved where the site serves pages, and the extension in the name is trusted. Then someone else's file opens by a link as part of your domain. For a visitor it is your site. For you it is a page you did not write.

What to ask the person who built the form

• Where the file physically lands and whether it can be opened as a page of the site.
• Whether the type is checked on the server, not only a ".pdf" label in the name.
• Whether there is a limit on size and on the number of uploads. A form without a limit becomes a way to fill the disk.
• Which employees download these files and whether they run them "just to look".

Antivirus on a manager's computer does not replace the form's setup. It does not see what is already being served to visitors from your domain. A WAF cuts some automated uploads and lets others through, especially if the file looks like an ordinary document. It is a filter, not a check of the logic.

On a website pentest Lexora looks at these forms separately when they are in scope: not "we break the server", but a check of whether an upload stays inside the scenario you yourself described. If the forms have not been looked at at all, new clients start with the free audit and we say whether a separate pass is needed. A fix on a site under our maintenance we close together with development.