Medium
File Upload
VaultDocs export polyglot
A small-business document store. The extension allow-list is correct; what serves the file back later trusts the wrong thing.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
VaultDocs only accepts .pdf, .docx and .xlsx uploads by extension. A separate "export as template" feature later re-serves a stored file inline, using whatever mime type was recorded for it at upload time.
Goal
Get one of your uploaded files re-served as HTML so a script runs on the site's own origin, and read /flag.php from there.