100%

app.py

@@ -59,7 +59,7 @@ def index():
 @app.route("/<path:filename>", methods=["GET"])
 def file(filename):
     """Convert a md file into HTML and return it"""
-    if not filename.endswith(".md"):
+    if not filename.endswith(".md") or "/" in filename:
         abort(404)
     with open(filename) as f:
         md = f.read()