CVE-2026-29909

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file that describes CVE-2026-29909, an unauthenticated directory enumeration vulnerability in MRCMS V3.1.2. It provides a single HTTP GET request as a 'Proof of Concept' that lists directory contents without authentication, which is a scanner behavior (detecting/reporting the vulnerability) rather than an exploit that achieves code execution or deeper compromise.

Backdoor review

No backdoor observed in reviewed code

The artifact consists solely of a README.md file describing CVE-2026-29909 and providing a simple HTTP GET request as a proof-of-concept. No executable code, scripts, or binaries are present. The PoC is a standard, non-obfuscated HTTP request that demonstrates the claimed directory enumeration vulnerability. There is no evidence of concealed behavior, credential theft, persistence mechanisms, or any other backdoor activity.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesMarkdownHTTP
Target softwareMRCMS
Attack typesdirectory_enumeration
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains only a single HTTP request that lists directory contents, which demonstrates the vulnerability (scanner) but does not include code to leverage the enumeration for further compromise (exploit). The file is a writeup with a PoC example, but the PoC itself is a scanner.

qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:9-13

Requirements

  • Target must be running MRCMS V3.1.2 with the vulnerable /admin/file/list.do endpoint exposed.qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:7

Observed behavior

  • Sends an unauthenticated HTTP GET request to /admin/file/list.do with a path parameter to enumerate server directory contents.qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:10-13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Http Request
GET /admin/file/list.do?path=../../../src/main/resources/ HTTP/1.1The PoC demonstrates the claimed unauthenticated directory enumeration vulnerability by sending a path traversal request to the target endpoint. This is consistent with the CVE description and does not indicate a backdoor.qflksheep-CVE-2026-29909-MRCMS-vulnerability-cc063d5/README.md:11-12
Review boundaries

What the analysis did not establish

  • Only one text file (README.md) is provided; no executable code or additional scripts are included.
  • The artifact is a documentation file, not an executable PoC script.
  • Only the README.md file was provided; no other files from the repository unit were included. The review is limited to the supplied text content.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1