EIP-2026-105478

This exploit demonstrates an arbitrary file upload vulnerability in Bilder Upload Script 1.09, allowing attackers to bypass file extension restrictions and upload malicious PHP scripts disguised as images. The PoC instructs users to upload a file with a double extension (e.g., evil.php.jpg) or manipulate the filename parameter to achieve remote code execution.