EIP-2026-107137

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Flatnux CMS by manipulating the 'theme' parameter with directory traversal sequences and a null byte. The PoC shows how to read arbitrary files (e.g., win.ini) by traversing directories and terminating the path with %00.