Download · Glitcher University

File: enrollment_letter.txt

GLITCHER UNIVERSITY — OFFICE OF THE REGISTRAR
This letter certifies that the named student is enrolled for Fall 2025.
(Sample student document.)

Resolved on server to: /app/studentfiles/enrollment_letter.txt

Objective Read a file that lives OUTSIDE the student documents folder.

💡 Show hint

The file parameter is joined onto a folder path. Climb out with ../ — e.g. file=../../tmp/secret/secret.txt, or file=../../etc/passwd.

FlawThe filename is used without sanitisation (path traversal). FixResolve the real path and confirm it stays inside the allowed folder; use os.path.basename + an allow-list.