A forgotten staging box: anonymous FTP leaks the source, an allow-list that resolves to localhost turns the URL previewer into an SSRF, and a tar wildcard in a root backup cron finishes the job.