EIP-2026-112601

This exploit demonstrates an unauthenticated remote code execution (RCE) vulnerability in TerraMaster TOS <= 3.0.30 by uploading a malicious PHP file via an insecure upload endpoint and executing arbitrary commands as root.