Day 22 10 min
Unsafe deserialization
1 / 11 · ≈ 9 min left
Warm-up
From yesterday. Answer from memory: a wrong guess still helps you remember.
The handler checks path.startswith("/srv/files") on the joined path. Why does ../../etc/passwd get through?