Every case, filed.

A file-viewer feature that trusted the filename parameter let me climb out of the intended folder and read arbitrary files on the server, flag included.

An XML external entity injection let me read arbitrary files off the server by hijacking a field that reflected parsed XML values back in the response.