EIP-2026-109355

This exploit demonstrates a local file inclusion vulnerability in Max's PHP Photo Album due to insufficient input sanitization. An attacker can traverse directories and include arbitrary files, such as '/etc/passwd', by manipulating the 'id' parameter in the URL.