3 ms·

The file dialog allows opening of folders as well, so the exploit is basically tricking the user into saying "I want to upload the folder C:\"