Path Traversal - Directory Escape

This file server allows users to download files from the /public/ directory. However, the server doesn't properly sanitize file paths, allowing you to escape the intended directory using path traversal sequences.

• The base path is /public/
• Your filename is appended directly: /public/{'{'}filename{'}'}
• Use ../ sequences to traverse up directories

Your goal is to read the flag file located at /root/flag.txt.

Learning Objective: Understand how path traversal attacks can break out of restricted directories to access sensitive system files.

Click to try common path traversal payloads:

• readme.txt
• logo.png
• terms.txt

/public/
├── readme.txt
├── logo.png
└── terms.txt

/uploads/
├── user1/
│   ├── photo.jpg
│   └── document.pdf
└── user2/
    └── notes.txt

/private/ [RESTRICTED]
/etc/ [SYSTEM]
/root/ [SYSTEM]