Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling

Target

Burp Suite Professional 2026.3.3 on Windows.

Summary

When Burp Scanner's browser-powered crawler crawls an attacker's website, the website can force Burp to write an attacker-controlled file to an attacker-controlled local path. For example, the PoC writes calc.exe into the current user's Startup folder, which triggers command execution when the user next logs in.

The issue is caused by Burp's handling of <input type="file">: Burp creates a local upload file from page-controlled attributes, but does not prevent path traversal in the generated filename.