EIP-2026-111516

This exploit demonstrates an unauthenticated Local File Inclusion (LFI) vulnerability in Processwire CMS 2.4.0. By manipulating the 'download' parameter in index.php, an attacker can retrieve arbitrary files from the server, such as /etc/passwd or config.php.