Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-112007. PoCs published by Pepelux.
AI-analyzed exploit summary The writeup details a local file inclusion vulnerability in sFileManager <= v.24a, where the 'filename' parameter in 'fm.php' is not properly sanitized, allowing directory traversal attacks to read arbitrary files. The 'pathext' parameter is protected against traversal, but the 'filename' parameter bypasses this check.
Description
sFileManager 24a - Local File Inclusion
Exploits (1)
The writeup details a local file inclusion vulnerability in sFileManager <= v.24a, where the 'filename' parameter in 'fm.php' is not properly sanitized, allowing directory traversal attacks to read arbitrary files. The 'pathext' parameter is protected against traversal, but the 'filename' parameter bypasses this check.