RELATIVE PATH FILE INJECTION: THE NEXT EVOLUTION IN RPO

Summary from the TLDR InfoSec newsletter

This article introduces a new attack method for injecting rogue files and forcing victims to download them. The attack requires a page to have a path confusion vulnerability, a download link with an anchor tag that uses relative paths, and content that is injectable via a persistent XSS or XSS cache poisoning. The attack expands on RPO because it doesn't rely on deprecated technologies.