EIP-2026-107516

The exploit demonstrates a file inclusion vulnerability in GTCatalog due to insufficient sanitization of the 'custom' parameter. By manipulating the URI, an attacker can include and execute arbitrary remote files, potentially leading to remote code execution.