EIP-2026-109133

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in LightOpen CMS v0.1 via the `smarty.php` file by manipulating the `cwd` parameter. The null byte (`%00`) is used to terminate the string and bypass file extension checks, allowing remote shell inclusion.