Preliminary research

L3akCTF 2026 "Squid": racing `/proc/self/fd` symlinks against Flask `send_file`

Jorian Woltjer · Jorian Woltjer

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Solves a Flask file-disclosure challenge by racing recycled procfs file descriptors between stat and open. A regular file supplies a nonzero length before an environment file replaces it, bypassing response-length suppression for zero-size procfs entries without requiring attacker-controlled filesystem writes.

Record

Researcher

Jorian Woltjer

Published by

Jorian Woltjer

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• ujson parser differential advisory

Tags

• toctou
• race-condition
• lfi
• python
• flask
• info-leak
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Jorian Woltjer, first published at the original source. Preserved copies are kept so the citation survives its host.