CVE-2026-40254 FreeRDP路径遍历漏洞

import os # Simulates the vulnerable logic in FreeRDP's contains_dotdot() def vulnerable_check(path): # The original code checks for substrings "../" or "..\\" # It fails to catch ".." at the end of a path component. if "../" in path or "..\\" in path: return False # Blocked return True # Allowed # Attack Scenario: Malicious server requests a file path # The attacker wants to access the parent directory of the shared folder. # Shared folder is at '/home/user/shared', attacker wants '/home/user'. payloads = [ "normal_file.txt", "../../etc/passwd", # Standard traversal, usually caught "subfolder/..", # The specific bypass case: .. at the end "subfolder/../secret.txt" # Caught because of trailing slash after .. ] print(f"{'Payload':<25} | {'Vulnerable Check':<18} | {'Status'}") print("-" * 60) for p in payloads: is_allowed = vulnerable_check(p) status = "ALLOWED (VULNERABLE)" if is_allowed and ".." in p else ("BLOCKED" if ".." in p else "ALLOWED (Safe)") print(f"{p:<25} | {str(is_allowed):<18} | {status}")