🎯 New Report #3712279: Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling
🔺Severity: High
👽 Reporter: kawakatz
⭐️ Reputation: 594
🛠 State: resolved
💼 Team: PortSwigger Web Security
💵 Bounty: 5000
🕐 Submitted: 2026-05-04
⏰ Disclosed: 2026-06-14 08:08:52
📝 Summary: A vulnerability was discovered in Burp Suite Professional 2026.3.3 on Windows. When Burp Scanner's browser-powered crawler crawled an attacker-controlled website, the website could force Burp to write an attacker-controlled file to an attacker-controlled local path. The issue was caused by Burp's handling of file input fields, where Burp created a local upload file from page-controlled attributes but did not prevent path traversal in the generated filename.
📂 Report JSON File: 3712279
@hackeronereports