EIP-2026-109450

This exploit demonstrates an authenticated file upload filter bypass in Microweber v1.0.3, allowing arbitrary PHP code execution by appending a dot to the filename to bypass extension restrictions. The PoC includes a multipart form upload request and a subsequent GET request to execute the uploaded PHP file.