Brief
A Vite 6.2.2 development server is exposed to the network, the way many
front-end teams run vite --host on a shared box.
Vite's dev server can serve files from anywhere on disk through its /@fs/ prefix,
and server.fs.deny / the serving allow list are supposed to keep that inside the
project. In versions before 6.2.3, 6.1.2, 6.0.12, 5.4.15 and 4.5.10 that check can be
bypassed.
Goal: read /flag from the server's filesystem.