Path Traversal - Profile Picture - Upload Filename

Vulnerability:
[PASS] Path Traversal - Profile Picture - Upload Filename

Description:
The test attempted to write a file outside the upload directory by inserting ../ sequences into the client-supplied filename. A comment in the source code states that path traversal is possible, so this endpoint was tested specifically.

Impact:
No impact. Control holds: Werkzeug's secure_filename function flattens the filename so ../ sequences are removed and the file remains inside the static/uploads directory. Writing a file to an arbitrary location was not achieved.

Note: the same endpoint is still flawed because it does not validate file type; this is reported separately in the Unrestricted File Upload finding.

CWE:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

OWASP:
A01:2021 - Broken Access Control

Scenario:
A file is uploaded with the name ../../../../tmp/pwned.txt intended to escape the upload directory. Result: the filename is flattened by secure_filename and the file is stored inside static/uploads, not in /tmp. Verification was done by retrieving the file at its actual storage location.

Endpoint:
POST http://127.0.0.1:5001/upload_profile_picture

Affected Feature:
Profile picture upload (filename handling)

Remediation:
- Keep using secure_filename.
- Ignore the client-supplied filename entirely and generate a random name server-side.
- Verify that the final path is inside the upload directory before writing the file.

POC:
1) (Screenshot 1) ATTEMPT: a file is uploaded with the name ../../../../tmp/pwned.txt -> the name is flattened, the file is stored inside static/uploads.
2) (Screenshot 2) RESULT: the file is retrieved at its actual storage location inside static/uploads, proving traversal did not occur and the control holds.