# Free storage on any bubble app? **URL:** \ **Category:** Bugs\ **Created:** [December 2, 2024, 4:45pm UTC](https://forum.bubble.io/t/free-storage-on-any-bubble-app/350535 "2024-12-02T16:45:34Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![AAL](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@AAL](https://forum.bubble.io/u/AAL)\ **Post date:** [December 2, 2024, 4:45pm UTC](https://forum.bubble.io/t/free-storage-on-any-bubble-app/350535/1 "2024-12-02T16:45:34Z")
It looks like anyone can upload files to any bubble app using a Post on the /fileupload endpoint. I’m concerned that this could be some exploit. Here are a couple of examples. One in [bubble.io](http://bubble.io) own instance, and another in an app of mine. Both successfully returned a file URL and the code is not set to provide any authentication. I get this is to allow anonymous users, for instance, to upload files. But I think that should be only where intended, not for any post request. ![image](https://us1.discourse-cdn.com/bubble/original/3X/0/6/06a110cd2cfd540fad5a5c899e313c5b3d0e0bb7.png) ![image](https://us1.discourse-cdn.com/bubble/original/3X/0/f/0f34a37922aabc3c0f61b536959a3b49730b37e2.png) ---
**Author:** ![tylerboodman](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/tylerboodman/32/242142_2.png) [@tylerboodman](https://forum.bubble.io/u/tylerboodman)\ **Post date:** [December 2, 2024, 6:00pm UTC](https://forum.bubble.io/t/free-storage-on-any-bubble-app/350535/2 "2024-12-02T18:00:14Z")
Yes unfortunately they still haven’t patched this 🤦🏼‍♂️ ---
**Author:** ![system](https://us1.discourse-cdn.com/bubble/original/3X/2/8/2847faa74692c2ffa5d939d3dc3724cdd060d247.png) [@system](https://forum.bubble.io/u/system)\ **Post date:** [December 16, 2024, 4:46pm UTC](https://forum.bubble.io/t/free-storage-on-any-bubble-app/350535/3 "2024-12-16T16:46:08Z")
Closed on December 16, 2024, 4:46pm UTC This topic was automatically closed after 14 days. New replies are no longer allowed.