Post

S2-067 is a fantastic bypass of the patch for S2-066. It uses ONGL to re-write the upload filename property in order to bypass the filename path traversal checks. PoC: if the target bean is called "UploadFile" the your target parameter is "top.UploadFileFileName". 🤯