← All labs
Modern Level 6 / 8 Hard

Insecure File Upload

An avatar uploader accepts your file. Get it treated as code.

Avatar / file uploader

Upload a file to your profile. Uploaded files are stored under /uploads/ and can be opened directly in the browser. Get the server to execute your file as code.

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.