Arbitrary file write
Named by 3 kept items in this workspace.
2 items name it under techniques and 1 under classification.key entities.
Search every workspace for Arbitrary file write. It matches the name as written, so it can find other things that share it.
The items that name it 3
Streamed bytes in SendQueryResult are written to the attacker-chosen path, with a two-request variant to create a new file with an exact name
Using save_to_file with a crafted path and content to write files outside the intended directory
All techniques in this workspace.