Track A · Stage 5

1. Normal use: /view?file=welcome.txt. Try /view?file=../../../../flag.txt (or /view?file=../secret/flag.txt). Why: the app builds open(BASE + file) with no normalization, so ../ climbs out of BASE to any readable path.

2. Classic target /etc/passwd works too, proving arbitrary read.

3. The flag file sits just outside the templates directory.

Lesson: resolve the real path and verify it stays within an allowed base (os.path.realpath + prefix check); never concatenate raw user input into paths.

1. The uploader saves files to /app/uploads/<name> and a route executes .py files placed there via exec. Upload a file pwn.py containing print(open('/flag.txt').read()). Why: the app never checks the extension or content and stores it in a directory it will execute from.

2. Visit /run/pwn.py — the server runs it and returns the flag.

3. A web-shell (import subprocess) would equally work.

Lesson: validate type/extension against an allow-list, store uploads outside the web root, randomize names, and never execute uploaded content.