EIP-2026-101683

The exploit demonstrates an arbitrary file disclosure vulnerability in ECOA Building Automation System via the 'fname' POST parameter in viewlog.jsp. It allows attackers to read sensitive files like /etc/passwd by traversing directories.