EIP-2026-106074

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in CometChat < v6.2.0 BETA 1 via the 'cc_lang' cookie. An attacker can manipulate the include path to execute arbitrary PHP code, potentially leading to remote code execution (RCE) if a malicious file is uploaded to the server.