File read / path traversal in favicon.php -> get source of helpers.php (contains path of flag) -> request flag from webserver.
https://advancedpersistentjest.com/2018/03/04/writeup-el33t-articles-hub-pragyan-ctf/