EIP-2026-110472
PRE-CVEPapoo CMS 3.7.3 - (Authenticated) Arbitrary Code Execution
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-110472. PoCs published by RedTeam Pentesting.
AI-analyzed exploit summary This advisory details an authenticated arbitrary code execution vulnerability in Papoo CMS 3.7.3, where users with image upload privileges can bypass file extension checks by uploading a PHP file with a valid GIF header. The exploit leverages the CMS's failure to validate file extensions, allowing PHP code execution when the file is accessed.
Description
Papoo CMS 3.7.3 - (Authenticated) Arbitrary Code Execution
Exploits (1)
This advisory details an authenticated arbitrary code execution vulnerability in Papoo CMS 3.7.3, where users with image upload privileges can bypass file extension checks by uploading a PHP file with a valid GIF header. The exploit leverages the CMS's failure to validate file extensions, allowing PHP code execution when the file is accessed.