POC1: field extraction + arbitrary file read/exfil (uploadImage.v1)