EIP-2026-108989

This exploit demonstrates an authenticated arbitrary file upload vulnerability in Kemana Directory 1.5.6, allowing remote code execution by uploading a malicious PHP script via multiple modules. The uploaded file is stored in the '/public/image/' directory and can be executed with a GET request.