EIP-2026-100354

This is a writeup describing an information disclosure vulnerability in HttpCombiner ASP.NET. The vulnerability allows remote attackers to read arbitrary files, such as web.config, by manipulating the 's' parameter in the HttpCombiner.ashx handler.