EIP-2026-114470

This PHP script exploits an arbitrary file upload vulnerability in FileManager by sending a POST request to 'xupload.php' with a user-supplied file path. The lack of input sanitization allows an attacker to upload malicious files, potentially leading to remote code execution.