Comment by tastroder

Not sure what the e-mail confirmation flow does but your upload leaks the fileId that can be used to construct the target URI without it.