EIP-2026-107846

This exploit targets Innovate Portal <= 2.0, leveraging a file upload vulnerability in the avatar upload functionality to achieve remote code execution. It authenticates as a user, uploads a malicious GIF file containing PHP code, and executes arbitrary commands.