The server used a vulnerable str_replace function allowing for a path traversal exploit. The str_replace function simply replaced '../' with a blank string. Using a payload of ....// or similar, we can achieve a path traversal.
