EIP-2026-110363

The exploit demonstrates an arbitrary file read vulnerability in osCommerce <= 2.2 via the 'extras/update.php' script, allowing attackers to disclose sensitive files like 'configure.php' or '/etc/passwd' by manipulating the 'readme_file' parameter.