EIP-2026-105336

The advisory describes a remote command execution vulnerability in AWF CMS 1.11 due to an unsanitized variable $spaw_root in spaw_control.class.php. The proof of concept demonstrates how an attacker can manipulate the spaw_root parameter to execute arbitrary commands.