How PHP Processes File Uploads

In short: When a browser uploads a file, it sends a POST request in the multipart/form-data format, in which form fields and file contents appear one after another as separate parts. PHP splits this request itself, writes each file part to a temporary file in upload_tmp_dir, records the details in $_FILES and only then starts your script. The script moves the file with move_uploaded_file(); everything that is not moved is deleted by PHP at the end of the request.

The path of a file from the browser to the script

For decision-makers, one thing matters above all: an upload is not an operation of the application alone. A large part of the work happens in the PHP interpreter before the code of the CMS or shop is even involved. That is why flaws in this part of PHP affect every website, whether or not it has an upload form.

The sequence at a glance:

1. The form with method="POST" and enctype="multipart/form-data" is submitted.
2. The web server accepts the request and passes it on to PHP, depending on the operating mode via PHP-FPM, mod_php or another interface.
3. PHP checks limits such as post_max_size and splits the content using a separator string, the so-called boundary.
4. Normal fields end up in $_POST; file parts are written to temporary files and described in $_FILES.
5. Only now does the script start, check the file and move it to its destination.
6. At the end of the request, PHP deletes all temporary files that were not moved.

multipart/form-data: the structure of an upload request

An upload request is plain text with embedded file data. The Content-Type header names the boundary, and within the body this character string separates the individual parts. Each part has its own header lines with the field name and, where applicable, the file name. A heavily shortened, harmless example:

POST /bewerbung HTTP/1.1
Content-Type: multipart/form-data; boundary=----trenner42

------trenner42
Content-Disposition: form-data; name="vorname"

Erika
------trenner42
Content-Disposition: form-data; name="lebenslauf"; filename="lebenslauf.pdf"
Content-Type: application/pdf

%PDF-1.7 ... Dateiinhalt ...
------trenner42--

All details in this text come from the sender, including the file name and the Content-Type of the part. PHP adopts them into $_FILES but does not check them for plausibility.

The $_FILES array

For a field named lebenslauf, $_FILES['lebenslauf'] contains these keys according to the PHP manual:

For fields with square brackets in the name, such as bilder[], each key contains an array with one entry per file. The application then iterates over, for example, $_FILES['bilder']['error'] and accesses tmp_name and name through the same index.

A form can additionally send a hidden MAX_FILE_SIZE field before the file field. According to the manual, this is only a hint to the browser and is easy to bypass. You can rely solely on the limits that the server enforces: in PHP, in the web server and in the application itself.

Limits: the php.ini directives for uploads

These directives control upload processing. The default values come from the PHP manual and apply when no php.ini overrides them.

post_max_size must be larger than upload_max_filesize, and according to the manual memory_limit should generally be larger than post_max_size. If upload_tmp_dir is not writable, PHP falls back to the system's temp directory. With open_basedir, the temp directory must be allowed, otherwise uploads fail. Practical values and their consequences are described in the article Setting sensible limits for post_max_size and upload_max_filesize.

Evaluating error codes correctly

The error field tells you what happened during processing. The constants range from UPLOAD_ERR_OK (0) through UPLOAD_ERR_INI_SIZE (1), UPLOAD_ERR_FORM_SIZE (2), UPLOAD_ERR_PARTIAL (3) and UPLOAD_ERR_NO_FILE (4) to UPLOAD_ERR_NO_TMP_DIR (6), UPLOAD_ERR_CANT_WRITE (7) and UPLOAD_ERR_EXTENSION (8).

<?php
declare(strict_types=1);

$datei = $_FILES['lebenslauf'] ?? null;
if ($datei === null) {
    exit('Keine Upload-Daten, eventuell wurde post_max_size überschritten.');
}

$meldung = match ($datei['error']) {
    UPLOAD_ERR_OK => null,
    UPLOAD_ERR_INI_SIZE, UPLOAD_ERR_FORM_SIZE => 'Datei zu groß.',
    UPLOAD_ERR_NO_FILE => 'Keine Datei gewählt.',
    default => 'Upload fehlgeschlagen.',
};

if ($meldung === null && is_uploaded_file($datei['tmp_name'])) {
    $ziel = '/srv/app/uploads/' . bin2hex(random_bytes(16)) . '.pdf';
    move_uploaded_file($datei['tmp_name'], $ziel);
}

The example shows only the mechanics. Checking the file type, storing files outside the web root and blocking script execution are described in the guide Implementing file uploads in PHP securely.

Uploads and PHP2Shell: what the interim measures mean

The PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect the processing surrounding the request in the PHP interpreter. That is why php.net names, among other interim measures, post_max_size = 8M (without uploads) or 32M (with uploads), upload_max_filesize below that, and session.upload_progress.enabled=0. These values belong in php.ini, the FPM pool or the server configuration, after which all workers must restart.

Specialist authors additionally suggest blocking multipart/form-data requests outside genuine upload paths at the proxy or in the WAF. This is an unofficial measure with the risk that forms break; the trade-off is described in the article Filtering upload requests at the edge. None of these measures replaces the update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

How does PHP SOS help?

• We determine which of your websites actually need uploads and on which paths.
• We set the limits and interim measures per pool, restart all workers and test the forms.
• We check upload directories for executable files and block script execution as part of server hardening.
• We apply the PHP update and document the patch status for each website.

Frequently asked questions

Sources

• PHP Manual: POST method uploads
• PHP Manual: Error messages explained
• PHP Manual: php.ini directives
• php.net: Security announcements