# VaultDocs — File Upload Bypass (lab)

> VaultDocs lets you upload a profile picture or document. The validation checks a file's declared type and its name for an allowed extension — but trusts the uploader on both.

Canonical: https://codelivly.com/labs/file-upload-bypass

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 250 |
| Session length | 30 min |
| Completions | 0 |

VaultDocs lets you upload a profile picture or document. The validation checks a file's declared type and its name for an allowed extension — but trusts the uploader on both. Smuggle a file past the filter and get the app to process it for you.

## Objective

Learn file upload bypass: when "is this an allowed file type" is decided from attacker-controlled signals (the Content-Type header, or a substring match on the filename) instead of the file's actual content, an attacker can disguise one file type as another and reach server-side processing meant only for safe formats.

## Tasks

1. Upload normally
2. Find the validation logic's blind spot
3. Craft a disguised upload
4. Trigger processing
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)