EIP-2026-102777

This exploit targets Apache::Gallery by replacing a shared library in a predictable world-writable directory (/tmp) with a malicious version. It binds a shell to port 12345, allowing privilege escalation to the Apache user (typically 'nobody').