Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-109848. PoCs published by haidao.
AI-analyzed exploit summary This exploit demonstrates arbitrary file read and write vulnerabilities in nconf 1.3 due to lack of input validation in the static_file_editor.php script. It allows reading sensitive files (e.g., ../config/mysql.php) and writing PHP code to the server.
Description
NConf 1.3 - Arbitrary File Creation
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by haidao · textwebappsphp
https://www.exploit-db.com/exploits/24270
This exploit demonstrates arbitrary file read and write vulnerabilities in nconf 1.3 due to lack of input validation in the static_file_editor.php script. It allows reading sensitive files (e.g., ../config/mysql.php) and writing PHP code to the server.
Classification
Working Poc 90%
Attack Type
Info Leak | Other
Complexity
Trivial
Reliability
Reliable
Target:
nconf 1.3
Auth required
Prerequisites:
Access to nconf web interface · Valid session cookies
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026