EIP-2026-114504

The exploit demonstrates a remote file inclusion vulnerability in YACS version 8.11. The vulnerability is due to insecure handling of the 'context[path_to_root]' parameter in 'update_trailer.php', allowing an attacker to include arbitrary remote files.