Lab: Web shell upload via path traversal
Summary: PortSwigger's lab presents an image upload function whose server is configured to block execution of user-supplied files, but the restriction can be bypassed through a secondary vulnerability. The walkthrough has the user upload a basic PHP web shell, change the filename in the Content-Disposition header to include a directory traversal sequence, and URL-encode the forward slash to obfuscate it, then use the shell to read /home/carlos/secret.
What's compelling: The control that was supposed to stop uploaded files from executing failed because a second flaw sat next to it, which is the pattern that turns a single upload bug into remote code execution on a production host.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026