OWASPASVS 5.0 requirement

ASVS-V5.3.1 Files uploaded or generated by untrusted input and stored in a public folder, are not executed as server-side program code when accessed…

L1 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V5 File Handling
Section: V5.3 File Storage
Level: L1 (requirement applies from this verification level up)

Requirement

Verify that files uploaded or generated by untrusted input and stored in a public folder, are not executed as server-side program code when accessed directly with an HTTP request.