EIP-2026-113366

This exploit targets a local file disclosure vulnerability in webSPELL <= 4.2.0d via the 'picture.php' script, which fails to sanitize the 'id' GET parameter. It allows an attacker to read arbitrary files by traversing directories.