EIP-2026-114610

This is a detailed security advisory describing a Remote File Inclusion (RFI) vulnerability in Zenphoto 1.4.11. The vulnerability arises due to improper sanitization of the 'tab' parameter in the admin-logs.php file, allowing an authenticated admin to include remote files when allow_url_fopen is enabled.