EIP-2026-106671

This exploit demonstrates an arbitrary file upload vulnerability in the FileDownload Plugin for e107, allowing an attacker to upload a malicious PHP file and disclose local files via path traversal. The PoC uses cURL to upload a file with PHP code and accesses sensitive files through a null byte injection.