EIP-2026-106127

This advisory details a Local File Inclusion (LFI) vulnerability in Concrete5 <= 5.7.3.1, stemming from improper path handling in the `Application::dispatch()` method. The vulnerability allows unauthenticated attackers to include arbitrary PHP files via manipulated HTTP headers like `X-Original-URL`.