Home/ Questions/Q 6319225
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T15:46:11+00:00

Is there any security risk in allowing a user to upload an HTML file

  • 0

Is there any security risk in allowing a user to upload an HTML file to our webserver?

Here are a few items to consider:

  • Only the user can access their html files
  • The file can contain javascript (if referenced from a different server)
  • The HTML file is stored as binary data in the database until the user requests the document

I am more concerned about risks to the system, not so much to the user, since it would have to have been them who uploaded the file (or someone else who already has access to their account).

Any suggestions are much appreciated!

Cheers,

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Pretty minimal if any. It’s HTML so you’re not executing anything on the server. If it’s absolutely, positively only viewed by the uploader then there’s no XSS or CSRF attack vectors of any value.

    Your biggest risk is probably in the upload function and ensuring there’s no malicious payload that could execute on the server side.

    • 0