Is it safe to include a 'File' type field into a webform that allows users (anonymous or authenticated) to upload their files? After reading few articles on the web , it seems it makes a website vulnerable to hacking and malware.

I would like to know better about this so that I can make a decision on this and provide an answer for and against using it.


Here is a security advisory from drupal.org that explains some of the dangers of letting anonymous users upload files: https://www.drupal.org/psa-2016-003


  • Configure upload fields that non-trusted visitors, including anonymous visitors, can upload files with, to utilize use the private file system.
  • Consider forcing users to create accounts before submitting content.
  • Audit your public file space to make sure that files that are uploaded there are valid.
| improve this answer | |
  • Thanks for your response @Wim. It means that it would make it safer by following all the 3 points and not by only utilising the private file system since people can still attach malicious pdfs. – SShingla Jan 13 '17 at 14:43
  • Exactly, and preferably have people create an account before they can upload. – Wim Mostrey Jan 13 '17 at 14:49
  • 2
    Even if you force users to create an account, the files should still not be placed in the public filesystem. Just because they took the time to register does not mean they can be trusted. Only let trusted users use the public filesystem. – Neograph734 Jan 13 '17 at 15:23
  • 1
    @Neograph734 I agree and I too had the same thought. Thanks for your response – SShingla Jan 13 '17 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.