EIP-2026-105818

The exploit demonstrates a Local File Include (LFI) vulnerability in Chaton <= 1.5.2 due to improper input validation in the 'chat_lang' parameter. The PoC shows how an attacker can manipulate the parameter to include arbitrary local files via null byte injection.