Dojo challenge #33 winners!

This report is a detailed write-up of a path traversal / local file inclusion vulnerability in a Python web app used as a Dojo challenge: it analyzes source code, identifies input validation weaknesses, shows how filters are bypassed via a file:// wrapper with an octal localhost (0177.1) and percent-encoding to read arbitrary files (POC: file://0177.1/tmp/secrets/f%6c%61%67.txt), reveals the challenge flag, and gives remediation guidance (file permissions, whitelists, stronger input validation).