July 19, 2026

Unrestricted File Upload via Exposed Upload Preset

Severity: Low Platform: HackerOne

By Kaens

Discovery

I just found interesting subdomain which i can't access. then, I checked historical snapshots of the target's static JS assets via the Wayback Machine. An archived JS bundle revealed hardcoded preset configuration parameters that should never have been exposed client-side:

  • cloudName: redacted_cloudname
  • uploadPreset: redacted_preset

Archived bundle:

https://web.archive.org/web/number/https://staging.redacted.in/_next/static/chunks/pages/jsfiles

This is a good example of how archived assets can leak secrets even after the subdomain has been removed, but the Wayback Machine preserved a snapshot.

Vulnerability

The application's /v1/api/file-upload/ endpoint relies on Cloudinary for storage, but doesn't appear to enforce meaningful file-type validation beyond what Cloudinary itself restricts by default. Testing showed:

  • .svg uploads were rejected (likely Cloudinary's own XSS-related restriction)
  • .png, .jpg, and critically .html were all accepted and hosted publicly

Because the uploadPreset and cloudName were exposed in the JS file, the application's own upload endpoint didn't even need to be touched Cloudinary's API could be hit directly using the leaked credentials.

Proof of Concept

Uploading an arbitrary HTML file:

bash

curl -X POST https://api.platform.com/v1_1/redacted_cloud/raw/upload \
  -F file=@test_name.html \
  -F upload_preset=redacted_preset

Result publicly accessible:

http://res.cloudinary.com/redacted_cloud/raw/upload/number/namefile.html

Also confirmed with image types:

bash

curl -X POST https://api.cloudinary.com/v1_1/redacted_cloud/image/upload \
  -F file=@test_name.jpg \
  -F upload_preset=redacted_preset

Result publicly accessible:

https://res.cloudinary.com/redacted_cloud/image/upload/number/filename.jpg

Both requests succeeded, resulting in attacker-controlled content hosted on a domain (res.cloudinary.com) that inherits trust from the platform.