Easy
File Upload
PixelFrame gallery upload RCE
A client-proofing photo gallery. The extension blacklist misses .phtml.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
PixelFrame lets photographers upload proofs for clients to review. The upload handler blocks .php, .php3, .php4 and .php5, and stores files in a web-reachable /uploads/ directory.
Goal
Upload a file the server will execute, and use it to read /flag.txt.