What calls what?

You could create a file named ; echo 'hi'; #

and it appears as if it would probably run anything you put between ; and # (in this case it will echo hi). Unless the filename is sanitized, which it appears to not be.

Yeah. Switch array & args disable the shell. I hope they’re not running that locally as the download script suggests. But then you still have a bunch of other security issues. Shrug.

I'm investigating the same. The upload endpoint uses secure_filename to get the filename used in that func. I'm not familiar with it, but the docs say it could return an empty string.