EIP-2026-104315

This exploit demonstrates a Server-Side XSLT Injection vulnerability in Magento 2.4.6, allowing arbitrary command execution via PHP functions embedded in XSLT templates. The PoC uses `shell_exec('id')` to confirm code execution in the context of the web server.