EIP-2026-112249

The exploit demonstrates a remote PHP code injection vulnerability in Smarty Template Engine versions prior to 3.0.7. By manipulating the template name to include a PHP file, an attacker can execute arbitrary PHP code in the context of the webserver process.