diff --git a/routes/productLeaflet.ts b/routes/productLeaflet.ts
new file mode 100644
index 00000000000..800a1f42fb3
--- /dev/null
+++ b/routes/productLeaflet.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import { type Request, type Response, type NextFunction } from 'express'
+import path from 'path'
+import fs from 'fs'
+
+// Serves the packaging leaflet that ships with each product.
+module.exports = function productLeaflet () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const leaflet = req.query.leaflet ?? 'default.md'
+    fs.readFile(path.join('ftp/leaflets', String(leaflet)), 'utf8', (error, text) => {
+      if (error != null) {
+        next(error)
+        return
+      }
+      res.type('text/plain').send(text)
+    })
+  }
+}
diff --git a/server.ts b/server.ts
index c2689cc8d39..79e42f06997 100644
--- a/server.ts
+++ b/server.ts
@@ -89,6 +89,7 @@ const resetPassword = require('./routes/resetPassword')
 const securityQuestion = require('./routes/securityQuestion')
 const search = require('./routes/search')
 const coupon = require('./routes/coupon')
+const productLeaflet = require('./routes/productLeaflet')
 const basket = require('./routes/basket')
 const order = require('./routes/order')
 const verify = require('./routes/verify')
@@ -568,6 +569,7 @@ restoreOverwrittenFilesWithOriginals().then(() => {
   app.get('/rest/user/whoami', security.updateAuthenticatedUsers(), currentUser())
   app.get('/rest/user/authentication-details', authenticatedUsers())
   app.get('/rest/products/search', search())
+  app.get('/rest/products/leaflet', productLeaflet())
   app.get('/rest/basket/:id', basket())
   app.post('/rest/basket/:id/checkout', order())
   app.put('/rest/basket/:id/coupon/:coupon', coupon())