EIP-2026-106485

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Docebo 3.6.0.2 by manipulating the 'modname' parameter in the URL to include arbitrary files, such as 'boot.ini', via directory traversal sequences. The PoC is tested on a specific environment (WampServer 2.0i) and provides a clear example of the vulnerability.