EIP-2026-108618

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in Joomla's CV Maker component (com_cvmaker) by manipulating the 'controller' parameter to traverse directories and include arbitrary files (e.g., /etc/passwd). The PoC is functional and straightforward, requiring no authentication.