ARCHIVE TRAP
Challenge
The service builds a find ... -execdir ... {} + command from user input and runs it, but rejects the request if the input string contains a blacklisted keyword like flag. The naive check is a plain substring test against the raw argument text.
The bypass
Shell word-splitting happens after the keyword filter sees the string, not before. Splicing an empty single-quoted pair into the middle of the banned word defeats a substring match while the shell still concatenates the pieces back into the literal word once it's actually executed:
"*" -execdir cat /win/fl''ag.txt {} +
The filter never sees the substring flag — it sees fl''ag — but after quote removal the shell hands cat the real path /win/flag.txt, and -execdir ... {} + runs it in the directory of each match.