EIP-2026-107760

This exploit targets a Local File Inclusion (LFI) vulnerability in If-CMS 2.07, allowing unauthenticated remote code execution (RCE) by injecting a PHP shell via session file manipulation. It leverages directory traversal and session fixation to write and execute arbitrary commands.