Is it possible to RCE?
You can solve the problem without doing an in-depth RCE. Take a close look at the code and find the flag path.