Use ClamAV to scan uploaded files

How to do it

ClamAV first came out in 2002, and Cisco Talos maintains it under GPL-2.0. Version 1.4 is the current long-term support line. Each such line gets fixes for three years from its first release, so 1.4 runs to August 2027. Version 1.4.6 shipped on 7 August 2026. The clamav/clamav image had about 78 million pulls on Docker Hub in October 2026. Run the clamd daemon with freshclam, which fetches new signatures. The app streams each file to clamd over its socket, so it needs no extra library. Set the size limits and the quarantine as Scan files for malware before anyone opens them says. Choose something else when files land in a cloud bucket whose provider sells scanning, such as GuardDuty Malware Protection for S3. Record that as a paid pick.

Examples

Shell example

docker run -d --name clamav -p 3310:3310 clamav/clamav:1.4
clamdscan --stream --no-summary quarantine/invoice-7.pdf

Python example

import socket
import struct

CHUNK_BYTES = 64 * 1024

def is_clean(path: str, host: str = "clamav.internal.example.com", port: int = 3310) -> bool:
    with socket.create_connection((host, port)) as conn, open(path, "rb") as upload:
        conn.sendall(b"zINSTREAM\0")
        while chunk := upload.read(CHUNK_BYTES):
            conn.sendall(struct.pack("!L", len(chunk)) + chunk)
        conn.sendall(struct.pack("!L", 0))
        return conn.recv(4096).strip(b"\0").endswith(b"OK")

How to check

clamd --version reports 1.4 or a newer long-term support line, with a signature date less than 24 hours old. Scanning the EICAR test file reports FOUND.

Sources

• OWASP File Upload Cheat Sheet

Related rules

• Scan files for malware before anyone opens them in API design