Forbidden Paths

Paths are filtered at URL, but not at the input box...

Just enter ../../../../flag.txt and click Read