EIP-2026-118713

This writeup describes a vulnerability in Kolibri+ Web Server 2 that allows remote arbitrary source code disclosure via a specific URL path manipulation. The vulnerability is triggered by appending '::$DATA' to the requested file path.