EIP-2026-112807

The exploit demonstrates a directory traversal vulnerability in Tugux CMS 1.2 via the 'pid' parameter in 'delete_page_parse.php', allowing remote arbitrary file deletion. The PoC includes a crafted HTTP POST request with traversal sequences to delete 'boot.ini'.