EIP-2026-109378

The exploit demonstrates a directory traversal vulnerability in mcNews by manipulating the 'skinfile' parameter to access arbitrary files on the server. The PoC URL shows how an attacker can read files outside the intended directory by using '../' sequences.