EIP-2026-108193

This exploit demonstrates an unauthenticated arbitrary file upload vulnerability in Joomla! ACYMAILING 3.9.0. The vulnerability arises due to lack of CSRF token validation, authentication checks, and file sanitization in the `setNewIconShare()` function, allowing attackers to upload malicious files.