Exposed and Exploitable: How an LFI Flaw Left a Travel Giant’s Server Files Open to Hackers

BeVigil identified a critical unauthenticated Local File Inclusion (LFI) in a travel-industry subdomain that exposes server root directories and arbitrary file contents via readfile?path= and loaddata?path= endpoints, revealing source code, configuration files, and hardcoded credentials; recommended mitigations include disabling the vulnerable endpoints, enforcing input validation and least-privilege file permissions, rotating secrets, and implementing monitoring.