EIP-2026-104155

The advisory details a persistent XSS vulnerability in AirDroid's message attachment functionality, where malicious filenames can execute arbitrary JavaScript in the victim's inbox. The PoC demonstrates the injection of a script tag via the filename parameter in a POST request.