EIP-2026-112425

The exploit demonstrates a file inclusion vulnerability in Statamic 4.7.0, allowing an attacker to upload a malicious HTML file that executes JavaScript to steal session cookies. The PoC is a simple HTML file with a script tag that triggers an alert with the document cookie.