**TL;DR**: Directory traversal vulnerability into source code leaks to identify Python backend with bottle-py. Identify pickling deserialization on `/sign` endpoint to get remote code execution to get the flag.