EIP-2026-103817

The exploit demonstrates a symlink attack against iPlanet Messaging Server's setuid binary `pipe_master`, which reads the first line of any file as root due to improper handling of the `CONFIGROOT` environment variable. The PoC shows how to leak the first line of `/etc/shadow` by symlinking `msg.conf` to it.