Path-Traversal

CachedWeb: chain SSRF with path control to reach the internal target and read the flag.

Jscalc: use path traversal to escape the intended read path and recover the flag.

Prying Eyes: use path traversal to escape the intended read path and recover the flag.

TimeKORP: use path traversal to escape the intended read path and recover the flag.