EIP-2026-107184

The exploit demonstrates a local file inclusion (LFI) vulnerability in Fork CMS by manipulating the 'file' parameter in a GET request to traverse directories and access sensitive files like '/etc/passwd'. The vulnerability arises from insufficient input sanitization in the 'frontend/js.php' endpoint.