tl;dr

There is a race condition in `context->FileName` var, this buf is used as the path after normalization, but it is the same buf where the username is written in the login. When sending a read request for "hello.txt", a new thread is created to do this, sending another request "USER /etc/passwd", the `context->FileName` buffer is changed and allows the reading of arbitrary files.

Original writeup (https://github.com/R3tr074/exploits/tree/master/CTFs/rwctf2023/pwn_NonHeavyFTP).