Medium
OS Command Injection
ArchiveIt tar wildcard injection
A personal backup tool. The folder name is properly escaped; the files inside it aren't.
PentestingHere Academy
Official Academy lab
- Attempts
- 3
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
ArchiveIt compresses a folder you've uploaded files into. The folder name is properly shell-escaped, but the tool runs tar czf backup.tar.gz * inside your folder, and you control which files are in it.
Goal
Achieve code execution using the files you place in the folder (not the folder name), and read /flag.txt.