file-access-vuln

A routing entry point, described as a P1 category router, for security testing of file access and upload workflows. Rather than containing exploitation payloads itself, it helps decide which specialized skill to load when parameters, filenames, download endpoints, or import flows influence file paths, or when a target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access. Its job is to classify the attack surface before deeper testing begins.

The core decision it drives is whether an issue is a path traversal / local file inclusion problem or an upload-validation and processing-chain problem. It maps to two main topic skills: Path Traversal LFI, which covers path traversal, arbitrary file read, wrapper abuse, and include chains; and Upload Insecure Files, which covers upload validation, storage paths, processing chains, overwrite risk, and preview/share boundaries. Small path-chain and upload-bypass samples are folded into those main skills, so no separate payload entry is needed.

The recommended flow is to first identify whether the entry point is a path parameter, a download endpoint, or an upload workflow, and then locate whether the issue appears in the accept, store, process, or serve stage of the pipeline. It also cross-references adjacent categories such as injection checking and business-logic vulnerabilities, since file-handling bugs frequently intersect with those areas. Use it at the start of assessing any filesystem-adjacent feature to route efficiently to the right deep-dive skill instead of guessing which technique applies.