작성에 뭔가 취약점이 있는거 같은데 어떤 부분을 더 봐야 할까요? templates도 /, ../가 필터링 되서 templates를 curl로 요청하는 것도 아닌 것 같아서요..

Is there a way to bypass this? Am able to get out of data/templates but am failing at bypassing this? Even in the os.path.normpath code I see no problem with the list. A little hint would be appreciated thanks.