EIP-2026-100324

This writeup describes a file upload protection bypass vulnerability in FCKEditor 2.6.8 ASP version. The vulnerability allows uploading files with arbitrary extensions by exploiting improper validation of duplicate filenames, using techniques like null character injection or semicolon-based extension manipulation.