EIP-2026-106310

The exploit demonstrates a remote file inclusion vulnerability in CuteNews aj-fork due to improper input sanitization. An attacker can include arbitrary files (e.g., /etc/passwd) via the 'config_skin' parameter, potentially leading to remote code execution.