EIP-2026-106968

The exploit demonstrates a local file inclusion (LFI) vulnerability in Exponent CMS by manipulating the 'controller' parameter to traverse directories and access sensitive files like 'win.ini'. It also mentions an arbitrary file upload vulnerability, though the provided code only shows the LFI vector.