EIP-2026-106488

PRE-CVE

DoceboLms 2.0.x - 'Lang' Multiple Remote File Inclusions

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-106488. PoCs published by beford.

AI-analyzed exploit summary The provided text describes a remote file inclusion vulnerability in DoceboLMS, where unsanitized user input allows an attacker to include arbitrary remote PHP files. The example URL demonstrates the exploitation vector via the 'lang' parameter.

Description

DoceboLms 2.0.x - 'Lang' Multiple Remote File Inclusions

Exploits (1)

exploitdb WRITEUP VERIFIED

by beford · textwebappsphp

https://www.exploit-db.com/exploits/27905

View Code ZIP pw:eip

The provided text describes a remote file inclusion vulnerability in DoceboLMS, where unsanitized user input allows an attacker to include arbitrary remote PHP files. The example URL demonstrates the exploitation vector via the 'lang' parameter.

Classification

Writeup 80%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: DoceboLMS 2.0.5

No auth needed

Prerequisites: Network access to the target application · Ability to host a malicious PHP file on an attacker-controlled server

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026