EIP-2026-106414

This exploit targets an arbitrary file upload vulnerability in Demo4 CMS Beta01 via the FCKeditor component. It bypasses file extension checks by using a double extension (e.g., 's.php.he.ll') and uploads a malicious PHP shell, enabling remote command execution.