EIP-2026-107077

The code describes an arbitrary file upload vulnerability in FestOS 2.3c, where the application fails to sanitize user input, allowing attackers to upload and execute arbitrary code via the TinyMCE plugin's upload.php endpoint.