EIP-2026-110527

This exploit demonstrates a Server-Side Template Injection (SSTI) vulnerability in PDF Signer v3.0, leading to Remote Command Execution (RCE) via maliciously crafted CSRF-TOKEN cookie values. The PoC shows how arbitrary PHP commands can be injected and executed, as evidenced by the `shell_exec('ls -lah')` example.