EIP-2026-119009

This exploit demonstrates a directory traversal vulnerability in Oracle Business Transaction Management Server's FlashTunnelService, allowing unauthenticated remote file deletion via a SOAP request. The PoC sends a crafted SOAP envelope to delete arbitrary files on the target system.