Path of Least Resistance

Challenge Question

A document viewer loads pages by name straight from a parameter in the URL. The developer knew this was risky and added a filter to block directory traversal, but the filter only runs a single time over the input. Work out how that sanitisation can be defeated and read a file on the server that the viewer was never meant to serve. This is a live challenge: you get your own private instance to attack.