EIP-2026-105053

This exploit demonstrates a directory traversal vulnerability in Ajax File Manager via the 'search_folder' parameter. By manipulating the parameter with '../' or '..%2f', an attacker can list files from arbitrary directories without authentication.