# Escaping images directory in S3 bucket when saving new avatar, using Path Traversal in filename

Avatar upload endpoint passed unsanitized filename to S3 key, letting `../` traversal escape the per-user directory and overwrite arbitrary bucket files.

- Payout: hidden
- Severity: medium
- Program: Unikrn
- Found by: sp1d3rs
- Disclosed: 2017-08-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/254200
- Library page: https://bugbountylibrary.com/r/h1%3A254200
- Tags: area:web domain:web impact:integrity impact:internal-access kind:bounty platform:hackerone sev:medium tech:aws tech:s3 vuln:file-upload vuln:path-traversal

**Target:** S3-backed avatar upload API endpoint (/apiv2/user/upload)
**Root cause:** The upload endpoint used the client-supplied filename directly when constructing the S3 object key, without sanitizing `../` sequences, so the key resolved outside the intended per-user prefix.
**Steps:**
1. Log in and open https://unikrn.com/profile
2. Upload any image as avatar and intercept the request to `https://unikrn.com/apiv2/user/upload`
3. Replace the filename with `test2../../../../../../test2.jpg` in the JSON body `{"filename": "test2../../../../../../test2.jpg", "type": "image/jpeg", "reason": "image/*", "session_id": "<session>"}`
4. Send the request
5. The file lands at the bucket root instead of `users/<userid>/<date>/`
**How found:** Researcher noticed the avatar URL structure `users/<userid>/<date>/<filename>` and hypothesized the filename was concatenated into the S3 key unsanitized, then tested `../` sequences.
**Exploitation:** An authenticated user uploads an avatar with a traversal filename, escaping the isolated `users/<userid>/<date>/` prefix to write or overwrite arbitrary objects anywhere in the S3 bucket, including files belonging to other users.
**Insight:** When an upload response URL reveals a predictable key prefix like `users/<id>/<date>/<filename>`, the filename segment is likely concatenated raw into the storage key — try `../` traversal to escape the per-tenant prefix and overwrite sibling objects.