Files That Can Upload Other Files

What this check and mySites.guru tool looks at on your site

This check searches every file in your Joomla site’s webspace for a call to the PHP function move_uploaded_file, and lists every file where it appears. This is the specific function PHP requires to move a file a visitor has uploaded out of a temporary location and into somewhere on your site, so it is the one place any genuine file-upload feature on the site has to touch.

Unlike the broader word search behind Files That Can Send Mass Email, this check targets one exact function name, which makes the result list shorter and each entry more worth reading.

Why an upload backdoor outlives the bug that planted it

A file-upload backdoor is one of the simplest and most durable things an attacker can plant. Once it is on the site, they no longer need to find or reuse the original vulnerability that got them in; they can just visit the backdoor directly and push up whatever they want next, from a full web shell to a batch of spam pages designed to rank in search engines under your domain’s reputation. move_uploaded_file is the function that makes this possible, and a script built entirely around abusing it can be a handful of lines long.

Most calls to this function on a real site are completely legitimate. Contact forms with attachments, media managers, avatar uploaders and import tools all need it, and Joomla itself uses it internally. That is exactly why this check does not try to guess intent from the function call alone; it lists every file that calls it and leaves the judgement about what each one actually does to you. What separates a legitimate handler from a backdoor is rarely the function call itself, it is everything around it: whether the file checks who is uploading, what type of file is allowed, and where the result gets saved.

An upload backdoor is also one of the more dangerous things to leave in place, because of what it enables next rather than what it does on its own. Once an attacker can push a file onto the site at will, the original way in stops mattering; a patched vulnerability, a rotated password or a fixed misconfiguration will not remove a working backdoor that survives independently of whatever let it in the first place. That is why this check exists as a standing part of the audit rather than a one-off scan: a backdoor planted today can sit unused for months before it is called on, exactly the kind of planted file the wider hunt for hacked files and backdoors is built to catch.

Every match tied to a real upload feature

A short list you can attribute entirely to extensions, components and core features you recognise: your contact form, your media manager, an import or backup tool. Each of those should restrict what can be uploaded (file type, size, and usually a login requirement) and save the result somewhere that is not directly executable.

What should concern you is a file with an unfamiliar name, sitting in a folder none of your installed extensions would use, that accepts an upload with no login required and no restriction on file type or destination. That combination, accept anything, from anyone, and put it anywhere, is close to a textbook description of an upload backdoor.

How to fix it

1. Work through the list and attribute each match to a real feature first. Most entries will map cleanly onto a contact form, media manager or similar tool you recognise installing.
2. Open anything unfamiliar and read what it actually restricts. Check for a login requirement, a file type or extension check, and where it saves the result. The absence of all three on an anonymous-facing file is the pattern to worry about.
3. Check the file’s location. A legitimate upload handler lives inside the extension it belongs to; a backdoor is often dropped somewhere unrelated, such as an images folder or a random-looking path with no other files nearby.
4. Test whether the file is reachable without logging in first, using a private or incognito browser window, since a genuine admin upload tool should always require authentication before it accepts anything.
5. If you confirm a backdoor, do not simply delete it and move on. Follow the full cleanup process on Hacked Files, because a working upload backdoor usually means the attacker has already used it at least once; dealing with a hacked Joomla site walks through the wider recovery steps from there.

What mySites.guru does about it

There is no one-click fix, since telling a legitimate upload handler apart from a backdoor needs a person to read what the code around the function call actually does. Finding every call across the whole site is part of the full audit rather than the fast twice-daily snapshot, so this list refreshes on the site’s audit schedule, weekly by default or daily or monthly if you have set it differently, and each match is listed with its file location for you to review.