Incorrect Default Permissions in Samsung FactoryCamera

This is a small proof-of-concept repository demonstrating a PHP filter-chain arbitrary file read / LFI scenario labeled as CVE-2026-21015. The repository contains two code files: vulnerable.php, which implements the vulnerable behavior, and exploit_php_filter.py, which performs the attack. The PHP script takes a user-controlled page parameter and passes it directly into include("php://filter/convert.base64-encode/resource=" . $file), allowing an attacker to supply traversal sequences and cause arbitrary local files to be included through the php://filter wrapper. Because the wrapper base64-encodes the file contents, the Python exploit simply sends a GET request to the vulnerable endpoint with page=../../../etc/passwd, then base64-decodes the response and prints the recovered file contents. The exploit has a single capability: arbitrary local file read / source disclosure from the web server context. It does not provide code execution, persistence, or post-exploitation features. Repository structure is minimal: LICENSE, README.md with usage notes, exploit_php_filter.py as the client PoC, and vulnerable.php as the intentionally insecure target example.