EIP-2026-108163

This exploit demonstrates a local file inclusion (LFI) and directory traversal vulnerability in eXtplorer due to insufficient sanitization of the 'lang' parameter. It allows remote code execution by including uploaded malicious PHP files or reading sensitive files like /etc/passwd.