EIP-2026-102245

This exploit demonstrates an arbitrary file upload vulnerability in HardDrive v2.1 for iOS, allowing remote attackers to bypass file extension checks and upload malicious files (e.g., webshells) via the `upload` POST method. The PoC shows how an attacker can upload a file with a deceptive extension (e.g., `exploit.html.js.png`) and later access it with a modified extension to execute arbitrary code.