Pre-Auth RCE with CodeQL in Under 20 Minutes (frycos.github.io)

Quite interesting that the actual exploit wasn't patched, unless os.path.exists returns false for unc shares.