A TOCTOU gap in a file upload

A race condition lives in the gap between validating a thing and acting on it. If two requests arrive close enough together, both can pass a check that only one should — spending a balance twice, redeeming a single-use code more than once, exceeding a limit that was true a millisecond ago.

This lab: A TOCTOU gap in a file upload. Slip through the window between a check and the action it guards.

Work it against your own copy of the target. When you have the flag, submit it below.

Find an action guarded by a check that is not atomic, fire it concurrently, and produce a result the limit was meant to forbid. Capture the flag the over-limit state reveals.