No writeups match your filter.
Path traversal via /view?file=../flag.txt reads the server-side flag file.