EIP-2026-105805

The writeup describes two file disclosure vulnerabilities in Chamilo 1.8.7 and Dokeos 1.8.6, allowing authenticated users to read arbitrary files via path traversal in `open_document.php` and `download.php`. The second flaw involves a flawed filter bypass using `..././` sequences.