EIP-2026-109734

The proof of concept describes a directory traversal vulnerability in MyBB versions prior to 1.8.11, where the 'pathfolder' parameter in the admin panel's smilies configuration module is not properly sanitized, allowing attackers to traverse directories. The vulnerability was fixed in version 1.8.11.