eladmin.md

#eladmin-File upload across directories

introduce

Front end Entrance

in the attack endpoint /api/database/upload

edit filename for ../../../../tmp/1.txt

and then u will see the file content has write into /tmp/1.txt

code Audit

as you can see 。 the fileName parameter has not valid the attack char with ../../../