EIP-2026-110846

The vulnerability in PHP-Nuke Web Mail module allows arbitrary PHP command execution by uploading a malicious PHP script as an email attachment, which is then stored in a web-accessible directory. The writeup describes the issue but does not include actual exploit code.