File Handling Flaws (Upload, Path Traversal, Local/Remote File Inclusion)
Reach the filesystem or reach code
Upload flaws usually come down to how the filename and content are validated. Test extension blacklists with alternate executable extensions (.phtml, .php5, .phar), case variation, trailing dot or space, and double extensions. Content-Type and magic-byte checks can be satisfied with a polyglot file. If .htaccess upload is allowed, you can make any extension executable. Also check whether filenames are used in a path join, which reintroduces traversal.
Path traversal and LFI share the same root: user input reaching a filesystem call. Try encodings (%2e%2e%2f, double encoding), absolute paths, and truncation, and note whether the code appends a suffix that forces you to break out with a null byte (legacy PHP) or a wrapper. realpath and basename are bypassed by symlinks, race windows, or by decoding after the check. PHP wrappers extend LFI: php://filter/convert.base64-encode/resource= reads source, php://input and data:// supply payloads when allow_url_include permits, and log poisoning or /proc/self/environ provide execution when plain inclusion is possible.
RFI requires allow_url_include and usually allow_url_fopen; confirm before planning on it. Zip-slip style archive extraction is another traversal path into upload features.
Traps: assuming a client-side MIME check matters; missing that the traversal happens in a parameter you considered cosmetic (template name, language file, avatar path); forgetting that images get re-encoded only sometimes.
Rule of thumb: for any file parameter, ask three questions - can I control the path, can I control the extension, and can I control the content? RCE needs all three, and often only two are checked.