EIP-2026-119330

The exploit demonstrates a directory traversal vulnerability in Pinky 1.0 by using URL-encoded backslashes to traverse outside the webroot and access sensitive files like 'windows/win.ini'. The attack relies on insufficient input sanitization to read arbitrary files.