EIP-2026-107414

This exploit demonstrates an unauthenticated remote code execution (RCE) vulnerability in GitList 0.6 by bypassing PHP's `escapeshellarg` function via argument injection in the `git grep` command. It sets up a local HTTP server to capture the output of the executed command.