EIP-2026-112743

This exploit demonstrates a local file inclusion vulnerability in TomatoCart by manipulating the 'class' parameter in the RPC endpoint to traverse directories and access sensitive files like /etc/passwd. The vulnerability arises from insufficient input sanitization.