From SSTI to Host Root: Compromising a Dockerized Environment in PwnUP CTF 2

How a Server-Side Template Injection vulnerability led to full host compromise through a privileged Docker container.