EIP-2026-106309

This exploit demonstrates an authenticated arbitrary file upload vulnerability in CuteNews 2.1.2, allowing low-privilege users (Editors) to bypass file upload restrictions and execute arbitrary commands by uploading a malicious PNG file with embedded PHP code and renaming it to a PHP extension.