EIP-2026-112085

PRE-CVE

Simple Directory Listing 2 - Cross-Site Arbitrary File Upload

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112085. PoCs published by Michael Brooks.

AI-analyzed exploit summary This is a functional exploit for a Cross-Site File Upload vulnerability in Simple Directory Listing 2.1 beta1. It uses a Flex application to upload a malicious PHP backdoor to the target server via a crafted multipart/form-data POST request.

Description

Simple Directory Listing 2 - Cross-Site Arbitrary File Upload

Exploits (1)

exploitdb WORKING POC VERIFIED

by Michael Brooks · textwebappsphp

https://www.exploit-db.com/exploits/7383

View Code ZIP pw:eip

This is a functional exploit for a Cross-Site File Upload vulnerability in Simple Directory Listing 2.1 beta1. It uses a Flex application to upload a malicious PHP backdoor to the target server via a crafted multipart/form-data POST request.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Simple Directory Listing 2.1 beta1

No auth needed

Prerequisites: Target server running Simple Directory Listing 2.1 beta1 · Network access to the target server

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1505.003 - Web Shell

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026