EIP-2026-106561

The exploit demonstrates a local file inclusion (LFI) vulnerability in Download Management for PHP-Fusion by manipulating the 'settings[locale]' parameter with a null byte (%00) to bypass input sanitization. This allows arbitrary local file access and potential execution of local scripts.