EIP-2026-110472

This advisory details an authenticated arbitrary code execution vulnerability in Papoo CMS 3.7.3, where users with image upload privileges can bypass file extension checks by uploading a PHP file with a valid GIF header. The exploit leverages the CMS's failure to validate file extensions, allowing PHP code execution when the file is accessed.