CWE-616: Incomplete Identification of Uploaded File Variables (PHP)

VariantIncomplete

The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

View on MITRE

Code Examples & CVEs

Demonstrative Examples

As of 2006, the "four globals" method is probably in sharp decline, but older PHP applications could have this issue.

In the "four globals" method, PHP sets the following 4 global variables (where "varname" is application-dependent):

BadPHP

$varname = name of the temporary file on local machine$varname_size = size of file$varname_name = original name of file provided by client$varname_type = MIME type of the file

"The global $_FILES exists as of PHP 4.1.0 (Use $HTTP_POST_FILES instead if using an earlier version). These arrays will contain all the uploaded file information."

** note: 'userfile' is the field name from the web form; this can vary.

BadPHP

$_FILES['userfile']['name'] - original filename from client$_FILES['userfile']['tmp_name'] - the temp filename of the file on the server

Observed CVE Examples (3)

CVE-2002-1460

Forum does not properly verify whether a file was uploaded or if the associated variables were set by POST, allowing remote attackers to read arbitrary files.

View Details

CVE-2002-1759

Product doesn't check if the variables for an upload were set by uploading the file, or other methods such as $_POST.

View Details

CVE-2002-1710

Product does not distinguish uploaded file from other files.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-616 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-616, Incomplete Identification of Uploaded File Variables (PHP), throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Incomplete Identification of Uploaded File Variables (PHP) during Architecture and Design

MITRE associates mitigation with Architecture and Design, and Implementation; recorded impacts include Read Files or Directories, and Modify Files or Directories; observed examples include CVE-2002-1460, CVE-2002-1759, and CVE-2002-1710. Use these source-defined anchors to turn CWE-616 into implementation, review, and verification checks for the affected component.

CWE-616: Incomplete Identification of Uploaded File Variables (PHP) — MITRE CWE

Triage CWE-616 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-616, Incomplete Identification of Uploaded File Variables (PHP), has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-616

Apply MITRE's full root-cause mapping guidance when using CWE-616, Incomplete Identification of Uploaded File Variables (PHP). Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-616 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-616, Incomplete Identification of Uploaded File Variables (PHP). Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-616: Incomplete Identification of Uploaded File Variables (PHP)?+

CWE-616: Incomplete Identification of Uploaded File Variables (PHP) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files. These global variables could be overwritten by POST requests, cookies, or other methods of populating or overwriting these variables. This could be used to read or process arbitrary files by providing values such as "/etc/passwd".

What are the security consequences of Incomplete Identification of Uploaded File Variables (PHP)?+

If exploited, CWE-616 (Incomplete Identification of Uploaded File Variables (PHP)) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Files or Directories and Modify Files or Directories.

How do you prevent or mitigate Incomplete Identification of Uploaded File Variables (PHP)?+

Recommended mitigations for CWE-616 include: Use PHP 4 or later. If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile'])) For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.

Which programming languages are affected by Incomplete Identification of Uploaded File Variables (PHP)?+

CWE-616 commonly affects PHP. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Incomplete Identification of Uploaded File Variables (PHP)?+

MITRE documents real CVEs mapped to CWE-616, including CVE-2002-1460, CVE-2002-1759 and CVE-2002-1710. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-616 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-616: Incomplete Identification of Uploaded File Variables (PHP)

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (3)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-616 with SSDF evidence

Address Incomplete Identification of Uploaded File Variables (PHP) during Architecture and Design

Triage CWE-616 against known exploitation evidence

Apply precise root-cause mapping to CWE-616

Validate CWE-616 with root-cause mapping checks

Frequently Asked Questions

Learn More