EIP-2026-107548

This exploit targets H2O-CMS <= 3.4 by injecting malicious PHP code into configuration parameters via a POST request, enabling remote command execution. It leverages authenticated access to modify settings and execute arbitrary commands through crafted HTTP requests.