EIP-2026-111670

This is a writeup describing a directory traversal vulnerability in Rama Zeiten CMS 0.99, allowing remote file disclosure via unsanitized input in the 'file' parameter of download.php. The example demonstrates accessing /etc/passwd.