EIP-2026-106090

This exploit demonstrates a remote file upload vulnerability in CompactCMS 1.4.0 via the tiny_mce plugin's upload.php endpoint. The POC provides a direct URL path for uploading arbitrary files, which can lead to remote code execution if malicious files are uploaded.