EIP-2026-106990

This writeup describes a stored XSS vulnerability in eyeOS <= 1.9.0.2, where malicious HTML files can be uploaded with image extensions and executed when opened. The PoC demonstrates uploading an HTML file disguised as a JPG, triggering an alert.