EIP-2026-107133

This writeup describes multiple local file inclusion vulnerabilities and a file upload bypass in Flatnux CMS. The upload bypass allows .phtml files to be uploaded, which may be executed as PHP depending on server configuration. Authentication is required for exploitation.