Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE