This is a public, intentionally-shareable file in /public_files.
Try the /download endpoint with a path traversal payload to reach files
outside this directory, e.g.:

  /download?file=../secrets/flag.txt