The server used a vulnerable str_replace function allowing for a path traversal exploit. The str_replace function simply replaced '../' with a blank string. Using a payload of ....// or similar, we can achieve a path traversal.

Original writeup (https://http418infosec.com/htb-cyber-apocalypse-ctf-2021-ministryplace-writeup).