EIP-2026-110958

This exploit targets a remote command execution vulnerability in PhpBB <= v2.0.20 by manipulating the 'default_lang' configuration to include a malicious avatar file with PHP code in its EXIF metadata. It also creates a backdoor user and file for persistent access.