Reaching an internal wkhtmltopdf service through a commented-out SSRF form, upgrading the GET-only fetch to a POST with gopher://, and reading /flag.txt out of the rendered PDF
Writeup for Web 2 Doc 2 from Nullcon HackIM CTF 2026. A Web challenge involving WeasyPrint LFI via PDF attachments.
