EIP-2026-108918

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Joomla! Plugin XCloner Backup 3.5.3. The vulnerability allows an authenticated attacker to read arbitrary files on the server by manipulating the 'file' parameter in the download task.