---
title: "Avoid insecure file uploads"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-other-services@main"
source: "Security/GuidelinesAdministrators/OtherServices.rst"
modified: "2026-09-14T11:10:56+00:00"
---

# Avoid insecure file uploads

Uploading untrusted scripts (e.g. PHP, Perl, Python) or executables into the
web root is a major security risk. TYPO3 prevents this via backend restrictions
(see [Global TYPO3 configuration options](https://docs.typo3.org/permalink/t3coreapi:security-global-typo3-options@main)).

These safeguards are bypassed if services like FTP,
SFTP, SSH, or
WebDAV allow direct file
uploads—commonly into `fileadmin/`.

Such access can lead to:

-   Upload of malicious scripts
-   TYPO3 Core files being overwritten
-   Abuse via leaked credentials

Recommended actions:

-   **Disable FTP/SFTP/SSH access** to the document root for users.
-   **Use the TYPO3 backend** for file uploads.
-   **Enforce secure upload policies** in the TYPO3 file storage configuration.

> [!WARNING]
> The TYPO3 Security Team considers FTP to be insecure due to the lack of encryption.
> **Do not use FTP under any circumstances.**