EIP-2026-106017

The exploit demonstrates a file inclusion vulnerability in CMSimple's filebrowser plugin, allowing remote PHP code execution by manipulating the `pth[folder][plugin]` parameter to include a malicious file from an attacker-controlled server.