Vulnerable code sample

import os

# This is a simplified representation of a web request handler,
# for example, in a framework like Flask or Bottle.

# Assume 'request' is an object provided by the web framework that
# contains form data ('request.form') and uploaded files ('request.files').
# Assume 'PROGRAMS_DIR' is the intended base directory for uploads.

PROGRAMS_DIR = 'st_files'

def vulnerable_upload_program(request):
    # 1. Get the uploaded file object from the request.
    uploaded_file_obj = request.files['file']

    # 2. Get the attacker-controlled filename directly from the form data.
    # No validation or sanitization is performed on this input.
    user_supplied_filename = request.form['prog_file']

    # 3. The CVE states the filename is stored in a database and retrieved later.
    # We simulate this by simply using the variable directly.
    # The vulnerability remains the same: using the raw, untrusted filename.
    filename_from_storage = user_supplied_filename

    # 4. The destination path is constructed using the untrusted filename.
    # If `filename_from_storage` is an absolute path (e.g., '/etc/passwd' or
    # '/opt/openplc/webserver/core/malicious.cpp'), `os.path.join` will
    # ignore the `PROGRAMS_DIR` and use the absolute path directly.
    destination_path = os.path.join(PROGRAMS_DIR, filename_from_storage)

    # 5. The file is saved to the constructed path, allowing an authenticated
    # attacker to write an arbitrary file to any location on the filesystem
    # where the web server process has write permissions.
    uploaded_file_obj.save(destination_path)