EIP-2026-112905

This exploit demonstrates arbitrary file disclosure and deletion in up.time 7.5.0 via unsanitized input to the 'file_name' parameter in 'get2post.php'. It allows reading and deleting local files with web server permissions.