cspshivam/playground
Modern Level 6 / 14 Hard
← All labs

Executable Upload

An avatar uploader screens for the obvious extension only. Slip through a file the server still runs as code.

Avatar / file uploader

Upload a profile picture. Uploaded files are stored under /uploads/ and can be opened directly in the browser. Get the server to execute your file as code.

The picker only offers image files. Uploading anything else — a different filename or Content-Type — means editing the multipart request itself.

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.