EIP-2026-113408

The exploit demonstrates a local file disclosure vulnerability in WHMCS (WHMCompleteSolution) versions 3.x.x and 4.0.x. By manipulating the 'templatefile' parameter in cart.php, an attacker can read arbitrary files on the server due to insufficient input validation.