Download · Glitcher University

File: campus_map.txt

Campus buildings: Library (A), Engineering (B), Student Center (C).

Resolved on server to: /app/studentfiles/campus_map.txt

Objective Read a file that lives OUTSIDE the student documents folder.

💡 Show hint

The file parameter is joined onto a folder path. Climb out with ../ — e.g. file=../../tmp/secret/secret.txt, or file=../../etc/passwd.

FlawThe filename is used without sanitisation (path traversal). FixResolve the real path and confirm it stays inside the allowed folder; use os.path.basename + an allow-list.