EIP-2026-106765

This exploit demonstrates an OS command injection vulnerability in ECSIMAGING PACS 6.21.5 via the 'file' parameter in /showfile.php. The www-data user has sudo NOPASSWD privileges, allowing escalation to root via crafted requests.