EIP-2026-114434

The exploit demonstrates an arbitrary file download vulnerability in XiVO 1.2's web interface, allowing unauthenticated attackers to retrieve sensitive files (e.g., /etc/passwd, /etc/shadow) via directory traversal in the 'id' parameter. The application runs with root privileges, exacerbating the impact.