In plain English
One file could pass as a harmless archive and still run code when the browser opened it.
The technical account follows below, for readers who want the detail.
Three lessons any team can use
Guessing a file type turns a file host into an execution surface.
Upload checks should read the bytes, not trust the extension.
Serve uploaded files from a separate, locked down origin.
The Challenge
A leading browser discards content type headers it cannot parse, then sniffs the body to guess. A file that is a valid archive and valid markup at once slips past upload checks as one thing and executes as the other, turning quiet file hosting into stored script execution in the origin.
How We Proved It
Built a generator that crafts spec valid archives opening with markup while keeping central directory offsets intact, paired with minimal server harnesses that reproduce the exact header conditions, and handed triage a complete kit: payload builder, capture server, MIME server, and video. When the report was flagged as a possible duplicate, proved it carried the missing reproduction the earlier report lacked. Severity assessed at P3 S3 with security review engaged.
Redacted vendor
May 4, 2026
Responsible Disclosure
Full Writeup
Researched and disclosed by Abang Obed. Read every step, payload, and takeaway.
Responsible disclosure is still in progress, so technical details stay private for now. Vetted clients can review the full account under NDA.
Ask about this workRelated Case Studies
More disclosures from our researchers.
Know your risk. Strengthen what matters.
Tell us where you are, what you rely on, and what you need to protect. We will help you understand what to do next.