EIP-2026-100654

This exploit demonstrates an arbitrary file upload vulnerability in Kartris 1.6 via a multipart/form-data POST request to the Admin/_GeneralFiles.aspx endpoint. The attacker can upload a malicious ASPX file, leading to potential remote code execution (RCE) if the file is executed.