<p>Craft will do some minimal cleansing of potentially malicious uploaded images by default by saving them back out to the file system and will try to sanitize SVG files as well.</p>

<p>It also has a relatively tame list of file extensions it allows on upload: <a href="https://docs.craftcms.com/v3/config/config-settings.html#allowedfileextensions" rel="nofollow noreferrer">https://docs.craftcms.com/v3/config/config-settings.html#allowedfileextensions</a></p>

<p>Anything outside of that, it'd be up to a Craft plugin or something on the server-side to do additional analysis and cleansing.</p>

CC BY-SA 4.0
2019-09-23T23:55:35.550Z
Thanks Brad, good to know.
Wei
CC BY-SA 4.0
2019-09-23T19:12:05.217Z
2019-09-23T19:12:05.217Z
Brad Bell
<p>I wonder if we have a form allowing file uploads for front end users, does Craft or its plugins have certain feature to scan for virus / malicious content, before saving it? If not, what would be the best practice to handle front-end users' uploads? E.g. shall it be handled by the hosting server, or is there a 3rd party library / service that can help?</p>

<upload><security><frontend-form>
Scan of front end user uploads
# Scan of front end user uploads

(Asked by: username_0 on 2019-09-23)

I wonder if we have a form allowing file uploads for front end users, does Craft or its plugins have certain feature to scan for virus / malicious content, before saving it? If not, what would be the best practice to handle front-end users' uploads? E.g. shall it be handled by the hosting server, or is there a 3rd party library / service that can help?

**Tags:** upload, security, frontend-form


---

## 1 answers

### Answer by username_1 on 2019-09-23. Score: 1

Craft will do some minimal cleansing of potentially malicious uploaded images by default by saving them back out to the file system and will try to sanitize SVG files as well.

It also has a relatively tame list of file extensions it allows on upload: <https://docs.craftcms.com/v3/config/config-settings.html#allowedfileextensions>

Anything outside of that, it'd be up to a Craft plugin or something on the server-side to do additional analysis and cleansing.

> **Comments:**
> **username_0**: Thanks Brad, good to know.  

---

