2 of 3 deleted 9 characters in body; edited title

Bypassing Directory Traversal Filter with separate Folder and File Inputs

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

Is is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?