EIP-2026-108466

This exploit demonstrates an unrestricted file upload vulnerability in Joomla's com_osproperty component, allowing an attacker to upload a malicious PHP shell by substituting it for a profile photo during agent registration. The uploaded shell can then be accessed via a predictable path in the /osproperty/agent/ directory.