---
name: validate-file-write
description: Evidence bar for writing files to the server. Use when validating a finding that claims arbitrary file write or path traversal on a write.
---

# Validate arbitrary file write

- Prove control of both the relevant path and file bytes by retrieving, loading, or otherwise observing a unique written marker from the target. An accepted upload, successful status, or attacker-generated message is not file-write evidence.
- Use the least invasive unique artefact needed for the claimed write. Document path, content and persistence restrictions supported by the evidence; a successful write does not itself establish execution.