EIP-2026-113264

The exploit demonstrates a local file inclusion (LFI) vulnerability in webEdition CMS by manipulating the DOCUMENT_ROOT parameter with a null byte (%00) to bypass input sanitization. This allows arbitrary local file execution in the context of the webserver process.