All the way to /etc
Keep climbing and you reach the filesystem root, then anywhere the www user is allowed to read:
curl -s 'http://127.0.0.1:8080/app/download?file=../../../etc/hostname'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/download?file=../../../etc/hostname' vulntech
Reading arbitrary local files like this is Local File Inclusion. On real targets it exposes config files, source code and credentials. The fix is to never build a path from raw input: resolve the final path and confirm it's still inside the allowed directory, or map requests to a fixed all-list of files.