EIP-2026-107173

The exploit demonstrates a remote file inclusion vulnerability in Foing's manage_songs.php script due to improper input sanitization. An attacker can inject a malicious remote URL via the foing_root_path parameter to execute arbitrary PHP code.