EIP-2026-106056

This exploit demonstrates a local file inclusion (LFI) vulnerability in Collaborative Passwords Manager 1.07 by manipulating the `_SESSION[user_language]` parameter to include arbitrary files (e.g., `/etc/passwd`). The null byte (`%00`) is used to terminate the file path, bypassing any appended extensions.