EIP-2026-105336
PRE-CVEAWF CMS 1.11 - 'spaw_root' Remote File Inclusion
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-105336. PoCs published by Federico Fazzi.
AI-analyzed exploit summary The advisory describes a remote command execution vulnerability in AWF CMS 1.11 due to an unsanitized variable $spaw_root in spaw_control.class.php. The proof of concept demonstrates how an attacker can manipulate the spaw_root parameter to execute arbitrary commands.
Description
AWF CMS 1.11 - 'spaw_root' Remote File Inclusion
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Federico Fazzi · textwebappsphp
https://www.exploit-db.com/exploits/1902
The advisory describes a remote command execution vulnerability in AWF CMS 1.11 due to an unsanitized variable $spaw_root in spaw_control.class.php. The proof of concept demonstrates how an attacker can manipulate the spaw_root parameter to execute arbitrary commands.
Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:
AWF CMS 1.11
No auth needed
Prerequisites:
Access to the target web application
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026