https://bokkapig.pages.dev/tags/lfi/Recent content in LFI on bokkapigHugoen-gbSat, 14 Mar 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/variatype/Sat, 14 Mar 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/variatype/Exploited fonttools CVE-2025-66034 designspace path traversal to write a PHP webshell, escalated to user via FontForge archive command injection, then root via setuptools PackageIndex arbitrary file write to cron.d.https://bokkapig.pages.dev/writeups/pterodactyl/Sat, 07 Feb 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/pterodactyl/Unauthenticated RCE via Pterodactyl Panel LFI (CVE-2025-49132), credential reuse for SSH, then privilege escalation via PAM session injection (CVE-2025-6018) chained with udisks2 XFS resize race condition (CVE-2025-6019) to obtain root.https://bokkapig.pages.dev/writeups/facts/Sat, 31 Jan 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/facts/Exploited CamaleonCMS path traversal (CVE-2024-46987) to extract MinIO credentials and an encrypted SSH key, then escalated via sudo facter –custom-dir to root.