EIP-2026-107541

This exploit demonstrates an unauthenticated file upload vulnerability in Gym Management System 1.0, allowing remote code execution by bypassing image upload filters via double extensions and manipulated Content-Type headers. The PoC uploads a malicious PHP file and establishes a webshell for command execution.