Lab 224 — ModelVault — Path Traversal via OCI Manifest Digest

hackadvisor

Task: AI model registry with OCI manifest import and blob viewer. Digest parameter in /api/blobs/{digest} is split on colon and used to construct filesystem path without sanitization. Solution: Path traversal via ../../../.. in digest hash portion to read /proc/self/environ, which contains the flag in the FLAG environment variable.