EIP-2026-104358

This exploit describes a null byte injection vulnerability in older versions of nginx (0.5.*, 0.6.*, 0.7 <= 0.7.65, 0.8 <= 0.8.37) that allows arbitrary code execution by appending %00.php to a URI, bypassing FastCGI module restrictions. The proof of concept demonstrates how null bytes can be injected into URIs to exploit the vulnerability.