Challenge

A “super simple file store” with upload and download. The /download/ API took a filename and joined it onto a base path without normalizing.

Approach

A trivial path traversal: request a ../ path through /download/ to step out of the upload directory and read an arbitrary file, including the flag. Easy money.