EIP-2026-107011

The exploit demonstrates a local file disclosure vulnerability via path traversal and a CSRF vulnerability to add an admin user in EZGenerator. The file disclosure uses a null byte injection, while the CSRF leverages a crafted form submission.