EIP-2026-108994

This exploit demonstrates a source code disclosure vulnerability in Kerio WinRoute Firewall's embedded web server. By appending a NULL byte followed by '.txt' to a PHP file path, an attacker can retrieve the source code of server-side scripts, exposing application logic.