EIP-2026-102434

This exploit demonstrates an arbitrary file deletion vulnerability in WSO2 API Manager 3.1.0 via a path traversal attack in the `extensionName` parameter of the `/carbon/extensions/deleteExtension-ajaxprocessor.jsp` endpoint. The PoC shows how an authenticated attacker can delete system files by sending a crafted POST request.