EIP-2026-110959

This Perl script exploits a poison NULL byte vulnerability in phpBB 2.0.21 to manipulate avatar file locations, allowing arbitrary file uploads. It authenticates as an admin, modifies the avatar path to include a NULL byte, and potentially enables remote code execution via malicious file uploads.