We recently published a breakdown of a subtle but impactful vulnerability: misconfigured upload paths that allow public access to uploaded files.

The core issue occurs when a webserver accepts file uploads but stores them in a directory directly accessible via the browser. If there’s no validation or access control, attackers can upload malicious files—like webshells or phishing pages—and access them immediately.

How do others approach detecting and preventing this kind of misconfiguration? Have you seen this exploited in the wild? What tooling or scanning techniques do you use to catch it?