# Files That Can Upload Other Files 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Files](https://mysites.guru/tools/file-information/) 4. Files That Can Upload Other Files # Files That Can Upload Other Files ![Files That Can Upload Other Files](https://mysites.guru/_astro/files-that-can-upload.DsjYHSof_cVU5z.webp) Every file on your Joomla site that calls PHP's move\_uploaded\_file, the function behind both ordinary upload forms and the classic file-upload backdoor. Article Contents - [How we find files that accept uploads](#how-we-find-files-that-accept-uploads) - [Why an upload backdoor outlives the bug that planted it](#why-an-upload-backdoor-outlives-the-bug-that-planted-it) - [Every match tied to a real upload feature](#every-match-tied-to-a-real-upload-feature) - [Matching each upload handler to a real feature](#matching-each-upload-handler-to-a-real-feature) - [Why upload handlers need a human review](#why-upload-handlers-need-a-human-review) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) ## How we find files that accept uploads This check searches every file in your Joomla site’s webspace for a call to the PHP function `move_uploaded_file`, and lists every file where it appears. This is the specific function PHP requires to move a file a visitor has uploaded out of a temporary location and into somewhere on your site, so it is the one place any real file-upload feature on the site has to touch. Unlike the broader word search behind [Files That Can Send Mass Email](https://mysites.guru/tools/file-information/files-that-can-send-email/), this check targets one exact function name, which makes the result list shorter and each entry more worth reading. ## Why an upload backdoor outlives the bug that planted it A file-upload backdoor is one of the simplest and most durable things an attacker can plant. Once it is on the site, they no longer need to find or reuse the original vulnerability that got them in; they can just visit the backdoor directly and push up whatever they want next, from a full web shell to a batch of spam pages designed to rank in search engines under your domain’s reputation. `move_uploaded_file` is the function that makes this possible, and a script built entirely around abusing it can be a handful of lines long. Most calls to this function on a real site are completely legitimate. Contact forms with attachments, media managers, avatar uploaders and import tools all need it, and Joomla itself uses it internally. That is exactly why this check does not try to guess intent from the function call alone; it lists every file that calls it and leaves the judgement about what each one actually does to you. What separates a legitimate handler from a backdoor is rarely the function call itself, it is everything around it: whether the file checks who is uploading, what type of file is allowed, and where the result gets saved. An upload backdoor is also one of the more dangerous things to leave in place, because of what it enables next rather than what it does on its own. Once an attacker can push a file onto the site at will, the original way in stops mattering; a patched vulnerability, a rotated password or a fixed misconfiguration will not remove a working backdoor that survives independently of whatever let it in the first place. That is why this check exists as a standing part of the audit rather than a one-off scan: a backdoor planted today can sit unused for months before it is called on, exactly the kind of planted file [the wider hunt for hacked files and backdoors](https://mysites.guru/blog/find-hacked-files-and-backdoors-in-joomla-and-wordpress/) is built to catch. ## Every match tied to a real upload feature A short list you can attribute entirely to extensions, components and core features you recognise: your contact form, your media manager, an import or backup tool. Each of those should restrict what can be uploaded (file type, size, and usually a login requirement) and save the result somewhere that is not directly executable. What should concern you is a file with an unfamiliar name, sitting in a folder none of your installed extensions would use, that accepts an upload with no login required and no restriction on file type or destination. That combination, accept anything, from anyone, and put it anywhere, is close to a textbook description of an upload backdoor. ## Matching each upload handler to a real feature 1. **Work through the list and attribute each match to a real feature first.** Most entries will map cleanly onto a contact form, media manager or similar tool you recognise installing. 2. **Open anything unfamiliar and read what it actually restricts.** Check for a login requirement, a file type or extension check, and where it saves the result. The absence of all three on an anonymous-facing file is the pattern to worry about. 3. **Check the file’s location.** A legitimate upload handler lives inside the extension it belongs to; a backdoor is often dropped somewhere unrelated, such as an images folder or a random-looking path with no other files nearby. 4. **Test whether the file is reachable without logging in first**, using a private or incognito browser window, since a real admin upload tool should always require authentication before it accepts anything. 5. **If you confirm a backdoor**, do not simply delete it and move on. Follow the full cleanup process on [Hacked Files](https://mysites.guru/tools/file-information/hacked-files/), because a working upload backdoor usually means the attacker has already used it at least once; [dealing with a hacked Joomla site](https://mysites.guru/joomla-hacked/) walks through the wider recovery steps from there. ## Why upload handlers need a human review There is no one-click fix, since telling a legitimate upload handler apart from a backdoor needs a person to read what the code around the function call actually does. Finding every call across the whole site is part of the full audit rather than the fast twice-daily snapshot, so this list refreshes on the site’s audit schedule, weekly by default or daily or monthly if you have set it differently, and each match is listed with its file location for you to review. ## [Files That Can Upload Other Files](https://mysites.guru/free-audit/?check=joomla/hacked/uploadfiles) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run as part of the full audit, which most sites schedule weekly. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/hacked/uploadfiles) ## Further Reading - [move\_uploaded\_file - PHP Manual](https://www.php.net/manual/en/function.move-uploaded-file.php) - the official documentation for the function this check searches for. - [Find Hacks and Backdoors in WordPress & Joomla](https://mysites.guru/blog/find-hacked-files-and-backdoors-in-joomla-and-wordpress/) - the wider process this check is one part of. ## Frequently Asked Questions Show all Why does move\_uploaded\_file matter more than other PHP functions? Because it is the specific function PHP requires to move a file from a temporary upload location into your webspace, and there is no legitimate way to accept a file upload without it. Every genuine upload form on your site calls it somewhere. So does a file-upload backdoor, which is why every call to it is worth an inventory even though most of them turn out to be completely legitimate. I found a file I do not recognise calling move\_uploaded\_file. What next? Open it and read what it actually does with the uploaded file: where it saves it, whether it checks the file type or extension, and whether it requires you to be logged in first. A genuine upload handler restricts what can be uploaded and where; a backdoor usually accepts anything, saves it somewhere executable, and needs no authentication at all. If in doubt, treat it as compromised and follow the cleanup steps on Hacked Files. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [How we find files that accept uploads](#how-we-find-files-that-accept-uploads) - [Why an upload backdoor outlives the bug that planted it](#why-an-upload-backdoor-outlives-the-bug-that-planted-it) - [Every match tied to a real upload feature](#every-match-tied-to-a-real-upload-feature) - [Matching each upload handler to a real feature](#matching-each-upload-handler-to-a-real-feature) - [Why upload handlers need a human review](#why-upload-handlers-need-a-human-review) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Ffiles-that-can-upload%2F&text=Files%20That%20Can%20Upload%20Other%20Files)[](https://bsky.app/intent/compose?text=Files%20That%20Can%20Upload%20Other%20Files%20https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Ffiles-that-can-upload%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Ffiles-that-can-upload%2F) Topics [Files](https://mysites.guru/tools/file-information/)Joomla ★★★★★ > "My [joomla-site](https://mysites.guru/manage-multiple-joomla-sites/) was [hacked](https://mysites.guru/blog/how-to-fix-a-hacked-joomla-or-wordpress-site-with-mysites-guru/) by 2 hackers that got in through an older version of JCE. Thanks to Phil my site was [completely cleaned](https://mysites.guru/blog/find-hacked-files-and-backdoors-in-joomla-and-wordpress/), updated and working again in less than 24 hours. Thx" ![Herman Vansynghel](https://mysites.guru/images/reviews/herman-vansynghel.webp) Herman Vansynghel [](https://mysites.guru/reviews/) ## More checks in [Files](https://mysites.guru/tools/file-information/) - [ ### Check Files That Are Not Core Files Every file on your site that Joomla or WordPress did not ship in its own release. On a typical site that is thousands of files, most of them entirely normal. ](https://mysites.guru/tools/file-information/files-that-are-not-core-files/) - [ ### Files That Can Send Mass Email Every file on your Joomla site containing the word mail, the starting point for finding a hidden spam relay or mailing backdoor an attacker planted. ](https://mysites.guru/tools/file-information/files-that-can-send-email/) - [ ### Hacked Files (100% Certain) A file appears here only when its hash matches a known hack, its name is unique to attacker uploads, or a live compromise was found on your site. ](https://mysites.guru/tools/file-information/hacked-files/) - [ ### Check Core Folders For Impostor Files Joomla ships a known, fixed set of files in every folder it owns. This check lists anything sitting in one of those folders that the CMS itself never put there. ](https://mysites.guru/tools/file-information/impostor-files-in-core-folders/) - [ ### Suspect Content In Files This check reads the content of every file on your site against roughly 1,500 hack patterns and lists matches for you to read and judge, not confirmed hacks. ](https://mysites.guru/tools/file-information/suspect-content/) ## More from the blog [ ![Clean a Hacked Site with Suspect Content and Hacked Files](https://mysites.guru/_astro/how-to-fix-a-hacked-joomla-or-wordpress-site-with-mysites-guru.DCoZGDWM_wK9es.webp) ### Clean a Hacked Site with Suspect Content and Hacked Files Use mySites.guru's Suspect Content and Hacked Files tools to find, confirm, and clean backdoors on a hacked Joomla or WordPress site, step by step. ](https://mysites.guru/blog/how-to-fix-a-hacked-joomla-or-wordpress-site-with-mysites-guru/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [How we find files that accept uploads](#how-we-find-files-that-accept-uploads) [Why an upload backdoor outlives the bug that planted it](#why-an-upload-backdoor-outlives-the-bug-that-planted-it) [Every match tied to a real upload feature](#every-match-tied-to-a-real-upload-feature) [Matching each upload handler to a real feature](#matching-each-upload-handler-to-a-real-feature) [Why upload handlers need a human review](#why-upload-handlers-need-a-human-review) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)