The CopyPasta public snippet listing (/api/snippets/public) builds its database filter directly from user-supplied query parameters. By injecting an ORM operator onto the is_public field, an attacker bypasses the visibility check and reads other users' private snippets, exposing the flag.
© 2026 Zw4rts. All rights reserved.
