EIP-2026-110615

The exploit demonstrates a Local File Inclusion (LFI) vulnerability in PhotoDiary 1.3 due to improper handling of the 'lng' parameter in /admin/install.php. The PoC shows how an attacker can traverse directories to read arbitrary files, such as /etc/passwd, by injecting path traversal sequences.