BreizhCTF 2026

Web challenge writeups from BreizhCTF 2026 — client+server chains mixing JSON type-confusion path traversal, SVG/CSP XSS, and Python import-shadowing RCE via gunicorn worker recycling.

0 categories 1 note

Notes

1 total

No thanks, I use AI — JSON-array traversal → SVG/CSP XSS → dotenv import-shadow RCE

Slip a path-traversal filename past an any(s in filename) blacklist by sending it as a one-element JSON array, planting JS in /static/js/. Load it from an uploaded SVG via <script href> to beat script-src 'self' and get admin XSS, then CSRF /api/admin/files/move to shadow python-dotenv in the app root and trip gunicorn's --max-requests worker recycle for RCE.

web web-server web-client xss svg csp-bypass +16