CVE-2018-20526

The exploit demonstrates path traversal and unrestricted file upload vulnerabilities in Roxy Fileman 1.4.5. Path traversal allows accessing arbitrary files via manipulated variables in copydir.php, copyfile.php, and fileslist.php. Unrestricted file upload enables uploading malicious files with double extensions (e.g., shellcode.php.png) if php.ini is configured with AddHandler php7-script .php.