EIP-2026-112471

This exploit targets SugarCRM 12.2.0 by uploading a malicious PHAR file disguised as a PNG image, achieving remote code execution. It leverages a file upload vulnerability in the EmailTemplates module to bypass restrictions and execute arbitrary commands.