Lab: Web shell upload via race condition
Summary: PortSwigger's lab presents an image upload function that validates files robustly, but moves each upload to an accessible folder before the virus check completes, so a malicious file can run in the window before removal. The lab asks the solver to upload a basic PHP web shell and use it to read /home/carlos/secret, logging in as wiener:peter, and notes the window is generous enough to exploit by sending two requests in quick succession via Burp Repeater.
Why it matters: The lab's own framing is that in the wild the window may only be a few milliseconds, which means a scanner that checks files after they land in a web-reachable directory has already handed an attacker the execution window it was meant to close.
Read the original at PortSwigger Research ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026