The application removes all dot-dot-slash patterns (../) in the user input to prevent path traversal. However, it do not check if a dot-dot-slash pattern remains after the first replacment. This makes it vulnerable to a path traversal. The attacker can use a nested dot-dot-slash pattern (..././) to escape the intended folder structure and access the flag file stored in the secret folder.

Payload:

..././..././secret/flag.txt