EIP-2026-100806

PRE-CVE

GlobalNoteScript 4.20 - 'Read.cgi' Remote Command Execution

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-100806. PoCs published by AcidCrash.

AI-analyzed exploit summary The exploit demonstrates a command injection vulnerability in GlobalNoteScript's read.cgi script via the 'file' URI parameter, which is passed unsanitized to Perl's open() routine. This allows remote command execution in the context of the web server.

Description

GlobalNoteScript 4.20 - 'Read.cgi' Remote Command Execution

Exploits (1)

exploitdb WORKING POC VERIFIED

by AcidCrash · textwebappscgi

https://www.exploit-db.com/exploits/25939

View Code ZIP pw:eip

The exploit demonstrates a command injection vulnerability in GlobalNoteScript's read.cgi script via the 'file' URI parameter, which is passed unsanitized to Perl's open() routine. This allows remote command execution in the context of the web server.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: GlobalNoteScript 4.20 and prior

No auth needed

Prerequisites: Network access to the target web server · GlobalNoteScript installed with vulnerable read.cgi script

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1202 - Indirect Command Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026