Fig 1One email, one GETHover to scrub · arrows stepfileName=../../../config.php
config.php card and the password wheel it setsShelves: Email/, Tmp/, MyFiles/, the install rootSendMail::setAttachment() joins the attachments folder and the file name without canonicalising, so three ../ climb to config.php and it is emailed out. The Deploy token is md5(db_name . db_user . db_password . date('Y-m-d H')) in the server's timezone, so the leaked credentials mint a valid one and /Deploy?action=disable-plugins runs with no session. 2026.7 requires realpath() to land inside MyFiles/Tmp/Email/.