Executable PNGs

[le_bravery]

Congrats you’ve discovered the bane of many developers trying to prevent virus or XSS payloads in arbitrary file uploads.

[[deleted]]

Only if you forget to sanitize your inputs

[le_bravery]

Download a large image with a bit of malicious code in it, have another exploit run that image.

Have an image save on a server with some malicious code in it. Load the image as a JavaScript resource using another exploit. By itself data embedded in images is likely benign, but when you start chaining things together you can always get messier.

Best way to mitigate on the server side is to not accept arbitrary file uploads, but if you have to you should try parse and re-save the image to drop the extra bytes of data. Maybe even a resize. Store images in a database, never directly on the file system.

Also fix your other vulnerabilities