CachedWeb: chain SSRF with path control to reach the internal target and read the flag.