EIP-2026-111894

This exploit demonstrates a file inclusion vulnerability in SAPID-SHOP 1.3, where the `root_path` parameter in `get_tree.inc.php` is used to include arbitrary remote files, leading to potential remote code execution (RCE). The PoC shows how an attacker can include a malicious file hosted on a remote server.