EIP-2026-110337

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in OrangeHRM 2.6.3 by traversing directories to access arbitrary files (e.g., `windows/win.ini`). The PoC uses path traversal sequences (`..%2f`) and a null byte (`%00`) to bypass restrictions.