EIP-2026-100658

This exploit targets a privilege escalation vulnerability in NopCommerce 4.2.0, allowing an authenticated attacker to upload a malicious .cshtml file via directory traversal in the RoxyFileman component, resulting in remote code execution (RCE). The PoC includes a fully functional web shell for command execution.