Challenge

A Flask web app with a file viewer: /view?file=<filename>.

Approach

The file parameter is passed to open() without sanitization. Use ../ to escape the intended directory:

1

GET /view?file=../flag.txt

The server returns the contents of /flag.txt.

Flag

boroCTF{c0ngr@tulat!0nS*}