Rating:

Problem author's writeup.

Summary: post a JS/WAVE polyglot with a .wave extension and XSS via the description field

Original writeup (http://dttw.tech/posts/r1jswRaAG).