CTF Challenge Shows How HTTP Request Smuggling Bypasses Path-Based Access Controls

A web challenge from BrunnerCTF 2026 demonstrated a classic CL.TE HTTP request smuggling vulnerability in a simulated internal wiki application. The target page, /wiki/internal/flag, was hinted at via robots.txt but returned a 403 Forbidden response to direct access. The exploit worked because the front-end proxy honored the Content-Length header while the backend Kestrel server prioritized Transfer-Encoding: chunked, causing the two layers to disagree on where one request ended and another began. By crafting a single POST request containing a smuggled GET for the restricted path, the attacker bypassed path-based authorization middleware that only applied to externally routed requests. The smuggled request reached Kestrel directly on the same keep-alive connection, returning the internal article and the hidden flag.