EIP-2026-109076

The exploit demonstrates a path traversal vulnerability in Lavalite CMS v9.0.0 via the XSRF-TOKEN cookie, allowing arbitrary file read access (e.g., /etc/passwd). The payload is embedded in the cookie, and the response confirms the vulnerability by returning the requested file.