# Unauthenticated file upload (Security) **URL:** \ **Category:** Questions\ **Created:** [March 5, 2025, 10:15am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110 "2025-03-05T10:15:15Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Noqode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/noqode/32/252685_2.png) [@Noqode](https://forum.bubble.io/u/Noqode)\ **Post date:** [March 5, 2025, 10:15am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/1 "2025-03-05T10:15:15Z")
A client recently had a pen test on their Bubble app. Any advice on handling unauthenticated file uploads? ![image](https://us1.discourse-cdn.com/bubble/original/3X/7/0/70eb0d060cb0919fa34eb413f721fca36f45e028.png) ![image](https://us1.discourse-cdn.com/bubble/original/3X/7/3/732e85cfb6cb37df9fe7c63863f61e9107313258.png) @fede.bubble @josh ---
**Author:** ![patrick.white](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/patrick.white/32/246565_2.png) [@patrick.white](https://forum.bubble.io/u/patrick.white)\ **Post date:** [March 5, 2025, 10:19am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/2 "2025-03-05T10:19:17Z")
This has been a vulnerability for far too long. Main forum for this issue: [Axios Upload](https://forum.bubble.io/t/guide-how-to-upload-files-to-the-file-manager-from-plugin-actions/273952) Doesn’t seem to be any way to prevent anyone from just uploading files via an axios command. smh ---
**Author:** ![Noqode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/noqode/32/252685_2.png) [@Noqode](https://forum.bubble.io/u/Noqode)\ **Post date:** [March 5, 2025, 10:22am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/3 "2025-03-05T10:22:48Z")
@fede.bubble Can you kindly raise this internally? This was highlighted to us by an external pentest. Feels quite ridicilous, i’m able to add files to any bubble app, with unauthenticated access. ![image](https://us1.discourse-cdn.com/bubble/optimized/3X/f/3/f340b5503f88b9325162f6d980828f5500e8409b_2_690x9.png) ---
**Author:** ![randomanon](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@randomanon](https://forum.bubble.io/u/randomanon)\ **Post date:** [March 5, 2025, 10:33am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/4 "2025-03-05T10:33:25Z")
I was under the impression that this had recently been patched. Guess not. They’ve known about this for years. They’ll just tell you, “it’s not a big deal we’ll delete the files if this happens to you.” ---
**Author:** ![Noqode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/noqode/32/252685_2.png) [@Noqode](https://forum.bubble.io/u/Noqode)\ **Post date:** [March 5, 2025, 10:51am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/5 "2025-03-05T10:51:22Z")
Just sent this to one of my apps, without authentication. ![image](https://us1.discourse-cdn.com/bubble/original/3X/e/7/e7f28a54fb4ae13d4eaf4fea7e73bd217986c233.png) ---
**Author:** ![fede.bubble](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/fede.bubble/32/215574_2.png) [@fede.bubble](https://forum.bubble.io/u/fede.bubble)\ **Post date:** [March 5, 2025, 7:19pm UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/6 "2025-03-05T19:19:33Z")
The team is aware of this and reviewing options ---
**Author:** ![Jici](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jici/32/30722_2.png) [@Jici](https://forum.bubble.io/u/Jici)\ **Post date:** [March 5, 2025, 8:51pm UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/7 "2025-03-05T20:51:26Z")
Absolutely no and more, I found some workaround for larger files! > [@Easy file upload to Bubble using API fileupload](https://forum.bubble.io/t/easy-file-upload-to-bubble-using-api-fileupload/323804/19): > > Ok. So from insomnia, I was able to send a file (private if needed) larger than 50 mb. But you need to have Bubble element ID that point to a fileuploader element set to max file size. After, the first step will be to send a POST request to https://yourdomain/version-test/fileupload/geturlwith this payload (you can replace the version to live if needed) {"public":true,"service":"bubble","timezone\_string":"America/Toronto","serialized\_context":{"element\_id":"aaaaa","current\_date\_time":174112660… I agree this is a security issue, but also think this kind of endpoint need to be available for dev. So maybe add a request to use api key @fede.bubble if the origin is outside of the Bubble app/server? ---
**Author:** ![nocodeventure](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nocodeventure/32/247164_2.png) [@nocodeventure](https://forum.bubble.io/u/nocodeventure)\ **Post date:** [March 5, 2025, 8:53pm UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/8 "2025-03-05T20:53:35Z")
Yes, this needs to be an authenticated endpoint👍 ---
**Author:** ![fede.bubble](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/fede.bubble/32/215574_2.png) [@fede.bubble](https://forum.bubble.io/u/fede.bubble)\ **Post date:** [March 5, 2025, 9:29pm UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/9 "2025-03-05T21:29:10Z")
I asked on your behalf: Here’s some more context on a potential fix. > the easy answer is, that wouldn’t change much to the overall security model - if this endpoint is “legal” from a plugin used inside your app in a way that is accessible if you’re not logged in, then that would still be required to stay open. the “origin” is also fakeable, so it’s not something that would add meaningful security ---
**Author:** ![Jici](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jici/32/30722_2.png) [@Jici](https://forum.bubble.io/u/Jici)\ **Post date:** [March 5, 2025, 9:57pm UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/10 "2025-03-05T21:57:16Z")
I forget that if not done by a browser, this can be fakeable. Whitelisting Bubble IP could be better? If the request come from Bubble IP, allowed, if not, api key requested? ---
**Author:** ![nocodeventure](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nocodeventure/32/247164_2.png) [@nocodeventure](https://forum.bubble.io/u/nocodeventure)\ **Post date:** [March 6, 2025, 6:02am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/11 "2025-03-06T06:02:46Z")
I don’t think we should confuse the matter too much, the first step would be to disable public access to uploading files to any bubble app without having to use an api token. @fede.bubble i hope you were answering jici. It’s still a problem on our end and we’ll be losing an enterprise customer potentially if this isn’t addressed. ---
**Author:** ![alexcooney5](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/alexcooney5/32/206227_2.png) [@alexcooney5](https://forum.bubble.io/u/alexcooney5)\ **Post date:** [March 6, 2025, 9:03am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/12 "2025-03-06T09:03:16Z")
I agree that this needs to be fixed, but would kindly suggest that the Bubble team gives some advance warning if there’s going to be a change to the /fileupload endpoint. There are plugins out there with 1000’s of installs that use this endpoint. Changing how it works without advance warning could cause a lot of apps to break. @fede.bubble ---
**Author:** ![nocodeventure](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nocodeventure/32/247164_2.png) [@nocodeventure](https://forum.bubble.io/u/nocodeventure)\ **Post date:** [March 6, 2025, 9:11am UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/13 "2025-03-06T09:11:47Z")
Agreed, it should be an experimental feature or something you can configure in the API tab. ---
**Author:** ![Noqode](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/noqode/32/252685_2.png) [@Noqode](https://forum.bubble.io/u/Noqode)\ **Post date:** [March 14, 2025, 12:52pm UTC](https://forum.bubble.io/t/unauthenticated-file-upload-security/362110/14 "2025-03-14T12:52:44Z")
@fede.bubble Do we have an update on this issue? It’s quite serious for enterprise users.