Self Checks

• I have read the Contributing Guide and Language Policy.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

The plugin upload endpoint accepts any file type because it trusts the client-supplied mimetype and filename. This allows uploading files with non-allowlisted or dangerous types (e.g., .php, .jsp, scripts) by spoofing the mimetype and/or suffix. Downstream consumers could be exposed to RCE, stored XSS, or data exfiltration if these files are rendered/executed/viewed elsewhere.

2. Additional context or comments

Affected area
api/controllers/files/upload.py – class PluginUploadFileApi.post

Impact / Risk
• Upload of server-side script files or binaries under benign extensions.
• Potential execution/rendering by other services or users (depending on deployment), leading to RCE/XSS.
• At minimum, policy violation for accepted file types.

Root cause
Server trusts request.files["file"].mimetype and the filename extension. There is no server-side allowlist nor content sniffing before persisting.

Steps to reproduce (high level)
1. Obtain a valid signed upload URL (existing flow).
2. POST a multipart form with a dangerous file (e.g., evil.jpg.php) while declaring type=image/png and filename=evil.png.
3. Upload succeeds; the file is stored and can be accessed via preview URL.

Expected
Uploads restricted to a small allowlist; content must match the declared/expected type.

3. Can you help us with this feature?

• I am interested in contributing to this feature.