CVE-2026-2749 Exploit Metadata

PoC files

18 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Technical assessment

The artifact contains Python scripts that exploit CVE-2026-2749, a path traversal vulnerability in Centreon Open Tickets. The primary script (poc.py) authenticates, uploads a PHP webshell via a path traversal in the uniqId parameter, executes commands to achieve RCE, and cleans up. A second script (poc_vector2.py) demonstrates arbitrary file deletion via the same traversal. A third script (poc_vector3.py) tests an alternative traversal vector via the filename, which is not exploitable.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC for CVE-2026-2749 is a straightforward path traversal exploit against Centreon Open Tickets. All three Python scripts (poc.py, poc_vector2.py, poc_vector3.py) use only the Python standard library to send HTTP requests to a user-specified target, upload a webshell or canary file, and clean up. No network connections are made to any third-party server, no data is exfiltrated, and no hidden or deceptive functionality is present. The behavior is fully consistent with the documented exploit chain.

ClassificationExploit

Model confidence100%

AuthenticationRequired

Languagespython

Target softwareCentreon Open Tickets

Attack typespath traversalremote code executionarbitrary file deletion

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is poc.py, which is explicitly designed to exploit CVE-2026-2749 by uploading a webshell and executing commands, achieving remote code execution. The README and verification report confirm successful exploitation. The code's stated purpose is to exercise the vulnerability, not merely detect it.

poc/poc.py:1-17poc/poc.py:18-41poc/poc.py:314-350poc_verification_report.md:1-10poc_verification_report.md:79-127

Requirements

Target running Centreon Open Tickets < 25.10.3 / < 24.10.8 / < 24.04.7poc/poc.py:33-34
Valid Centreon user credentials (any privilege level)poc/poc.py:34
Python 3.6+ (stdlib only, no external dependencies)poc/poc.py:35

Observed behavior

Authenticates to Centreon via POST to /centreon/login.php and extracts PHPSESSID cookiepoc/poc.py:153-186
Uploads a PHP webshell via path traversal in the uniqId parameter of a multipart POST to call.php?action=upload-filepoc/poc.py:188-243
Executes arbitrary commands (id, whoami, uname -a, cat /etc/hostname) via the uploaded webshell to prove RCEpoc/poc.py:245-280
Cleans up by deleting the webshell via a path traversal in the remove-file actionpoc/poc.py:282-312
Demonstrates arbitrary file deletion by creating a canary file via upload traversal and deleting it via remove-file traversalpoc/poc_vector2.py:133-180

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target: User-supplied host and port (default 172.22.0.3:80)All scripts connect exclusively to the target specified by the operator via command-line arguments or hardcoded defaults, which is the disclosed vulnerable Centreon instance.poc/poc.py:354-355poc/poc_vector2.py:231-232poc/poc_vector3.py:236-237
Webshell Payload: <?php echo "CVE-2026-2749-RCE:" . shell_exec($_GET["cmd"]); ?>The webshell is uploaded to the target Centreon server as part of the disclosed RCE exploit. It is executed on the target, not the operator's machine.poc/poc.py:69
Credential Usage: admin:Centreon!2021Hardcoded default credentials used to authenticate to the target Centreon instance. These are standard lab credentials documented in the README and not used to access any external service.poc/poc.py:61-62README.md:118

Review boundaries

What the analysis did not establish

Evidence includes only selected text files; 11 unclassified files and 1 non-text media file are present but not analyzed.
The analysis is based solely on static code review of the provided text; the exploit code was not executed.
The evidence packet reports complete_artifact_coverage is false, indicating not all artifact files were included.
The review is based solely on the supplied text files; binary files and the Docker environment were not inspected.
The analysis assumes the operator runs the PoC against their own lab environment as intended; misuse against unauthorized targets is outside the scope of backdoor review.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-2749/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-2749Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2026-2749/docker-compose.yml

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Environment assessment

A single-container Docker lab that reproduces a path-traversal vulnerability (CVE-2026-2749) in Centreon Open Tickets. It runs a minimal PHP 8.2 + Apache server with mock Centreon endpoints, exposing port 8080 on the host.

CVE-2026-2749/docker-compose.yml:1-29CVE-2026-2749/Dockerfile.vulnerable:1-53CVE-2026-2749/README.md:1-236

Lab assessment

Vulnerability lab

The README, Dockerfile, and compose file explicitly describe a lab environment for reproducing CVE-2026-2749, a path-traversal vulnerability in Centreon Open Tickets. The container runs vulnerable PHP endpoints and is accompanied by PoC scripts that demonstrate the exploit chain.

CVE-2026-2749/README.md:1-10CVE-2026-2749/docker-compose.yml:1-3CVE-2026-2749/Dockerfile.vulnerable:1-3

Lab shapeCompose · mixed

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable

vulnerable targetweb server

A PHP 8.2 + Apache container serving mock Centreon endpoints, including the vulnerable uploadFile.php and removeFile.php scripts. It exposes port 80 internally, mapped to host port 8080, and includes a mock login endpoint for authentication.

CVE-2026-2749/docker-compose.yml:8-25CVE-2026-2749/Dockerfile.vulnerable:4-53

poc.py

exploit scriptprimary PoC

A Python 3 script that exploits the path-traversal vulnerability to upload a PHP webshell, execute commands, and clean up. It targets the vulnerable container's uploadFile.php and removeFile.php endpoints.

CVE-2026-2749/poc/poc.py:1-359

poc_vector2.py

exploit scriptsecondary PoC

A Python 3 script that demonstrates arbitrary file deletion via the removeFile.php endpoint using path traversal.

CVE-2026-2749/poc/poc_vector2.py:1-236

poc_vector3.py

exploit scripttest script

A Python 3 script that tests whether path traversal is possible through the uploaded filename field. The test concludes that this vector is not exploitable because PHP strips directory components.

CVE-2026-2749/poc/poc_vector3.py:1-240

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-2749

Supported by supplied evidence

The lab environment is explicitly built to reproduce CVE-2026-2749. The vulnerable PHP files (uploadFile.php, removeFile.php) contain unsanitized path concatenation, and the PoC scripts successfully demonstrate path traversal leading to RCE and arbitrary file deletion, as documented in the verification report.

CVE-2026-2749/vulnerable/uploadFile.php:24-28CVE-2026-2749/vulnerable/removeFile.php:24-25CVE-2026-2749/poc_verification_report.md:1-283

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed on the host.CVE-2026-2749/README.md:88-93
Host port 8080 available for mapping to the container's port 80.CVE-2026-2749/docker-compose.yml:15-16
Python 3.6+ with standard library only to run the PoC scripts.CVE-2026-2749/README.md:108-109
Valid Centreon credentials (admin / Centreon!2021) for the mock login endpoint.CVE-2026-2749/README.md:100-103

Evidence-described exercise path

Build and start the vulnerable container with `docker compose up -d`.CVE-2026-2749/README.md:88-93
Run the primary PoC script `python3 poc/poc.py localhost 8080` to authenticate, upload a webshell via path traversal, execute commands, and clean up.CVE-2026-2749/README.md:108-112CVE-2026-2749/poc/poc.py:1-359
Optionally run `poc_vector2.py` to demonstrate arbitrary file deletion, or `poc_vector3.py` to test filename-based traversal.CVE-2026-2749/README.md:148-163
Tear down the lab with `docker compose down`.CVE-2026-2749/README.md:95-96

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable container. The PoC scripts upload a webshell, execute commands, and delete files only within the container. There is no evidence of host compromise, external communication, persistence, credential theft, or any action outside the documented exercise. The port mapping and Docker exec commands are standard lab prerequisites and do not indicate malicious intent.

CVE-2026-2749/poc/poc.py:1-359CVE-2026-2749/poc/poc_vector2.py:1-236CVE-2026-2749/poc/poc_vector3.py:1-240CVE-2026-2749/docker-compose.yml:1-29

Review boundaries

What the analysis did not establish

The packet does not include the actual Centreon application; it uses a minimal mock that may not fully replicate all attack surface nuances.
The PoC scripts target a hardcoded default IP (172.22.0.3) when no arguments are supplied, but this is a private Docker network address and is not probed automatically.
The verification report references `docker exec` commands for manual verification, which are operator-controlled and not part of automated exploit behavior.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-2749