EIP-2026-107529

The exploit demonstrates arbitrary file read/write vulnerabilities in GuppY via the tinymsg.php component. It allows an attacker to manipulate poll data, write arbitrary files, and read sensitive files (e.g., admin password hashes) by leveraging path traversal and null byte injection.