https://lukaszpastuszak.dev/tags/file-upload/Recent content in File-Upload on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/permx/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/permx/An unauthenticated file upload in Chamilo LMS (CVE-2023-4220) gives RCE as www-data, a reused database password reaches mtz, and a symlink-following sudo ACL script escalates to root.https://lukaszpastuszak.dev/writeups/timing/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/timing/A login timing side channel enumerates users, mass assignment sets role=1, an LFI plus php://filter discloses source, a predictable MD5(time()) upload name gives RCE, a git history leak yields a reused password, and Axel's .axelrc default_filename overwrites root's authorized_keys.