EIP-2026-108914

This exploit demonstrates a Local File Disclosure (LFD) vulnerability in Joomla Captcha Plugin <= 4.5.1. The vulnerability arises from unsanitized user input in the 'lng' parameter, allowing directory traversal to read arbitrary files on the server when magic_quotes_gpc is disabled.