Rick's Gallery ASIS CTF 2025 Finals — Writeup

Exploit a case-sensitive filter bypass leading to SSRF and LFI to read the flag from /tmp/flag.txt.