EIP-2026-106614

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in DZCP 1.5.4 by manipulating the `[prefix]_language` cookie parameter to traverse directories and include arbitrary files. The PoC is minimal but functional, requiring only a crafted cookie to exploit the vulnerability.