TryHackMeMedium
Hacker Holidays — Day 10: The Hollow Shell
A zip-slip flaw in a staff upload feature lets an extracted archive entry escape its per-upload folder and overwrite the app's own live Jinja template, turning a simple file upload into persistent SSTI/RCE.
- #hacker-holidays
- #zip-slip
- #ssti
- #file-upload