This one is more tricky for me because of all of the things you aren't allowed to do. I kept getting the "You are on the right track" message.
2 things that have been mentioned in this topic:
Server side includes (check the basic commands, it should hit you, especially if you read the first sentence of the description).
Second, think about where your input gets sent, and where the file you're looking for might be (directory hierarchy, again see commands on how to go back and forth).
Last but not least, the description tells us that there is no security, so it's pretty simple when you get the syntax right.