EIP-2026-111693

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in rConfig 3.9.6 via the 'path' parameter in /lib/ajaxHandlers/ajaxGetFileByPath.php. Authenticated users can read arbitrary files on the server by traversing directories (e.g., ../../../../../../etc/passwd).