EIP-2026-112841

The document describes a Local File Inclusion (LFI) vulnerability in u5CMS 3.9.3 and 3.9.2, where the 'f' parameter in thumb.php is not properly sanitized, allowing directory traversal attacks. It includes example HTTP requests demonstrating the exploit.