EIP-2026-105970

This is a writeup describing a local directory traversal vulnerability in CMS from Scratch <= 1.1.3, allowing arbitrary file access and potential shell upload via the 'images.php' script. The exploit leverages improper input validation in the 'dir' parameter.