EIP-2026-105969

This exploit targets a file upload vulnerability in CMS from Scratch <= 1.1.3, allowing arbitrary PHP file uploads via the FCKeditor component due to misconfigured allowed extensions. It uploads a shell and provides interactive command execution.