The solution is quite simple, once we realise that we can curl for files inside a file system using `file://`.

With this in mind, we simply send `file:///flag` to our POST endpoint at `/api/curl`, and immediately get the flag

Original writeup (https://kblagoev.com/blog/caas-cyberapocalypse-2021-ctf/).