The solution is quite simple, once we realise that we can curl for files inside a file system using `file://`.
With this in mind, we simply send `file:///flag` to our POST endpoint at `/api/curl`, and immediately get the flag