Path traversal, to RCE

The researcher found a path traversal vulnerability in the Gitlab package registry API that allows an attacker to write to any path writable by git user, potentially allowing an attacker to write to authorized_keys with their public key and get a ssh shell.