EIP-2026-112092

This exploit demonstrates an arbitrary file download vulnerability in Simple File Uploader by crafting a base64-encoded filename parameter in the download.php endpoint. It allows unauthorized access to files on the server.