Repetier-Server 1.4.10 - Path Traversal

ExploitDBExploitDB exploitScannerEDB-52540

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that attempts to read arbitrary files from a Repetier-Server target via path traversal. It sends HTTP GET requests with traversal payloads and checks the response status and size to determine success, but does not deliver a payload or execute code on the target.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward path traversal exploit script for Repetier-Server. It constructs traversal payloads, sends HTTP GET requests, and prints the response. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The script includes a standard warning to test only on authorized systems.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareRepetier-Server
Attack typesPath Traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only sends HTTP requests to read files and reports success based on response characteristics. It does not deliver a payload, establish a shell, or execute commands on the target. This is consistent with a scanner that checks for the vulnerability without exploiting it.

exploits/multiple/webapps/52540.py:20-50

Requirements

  • Target must be running Repetier-Server version <= 1.4.10exploits/multiple/webapps/52540.py:1
  • Target URL must be reachable over HTTPexploits/multiple/webapps/52540.py:37

Observed behavior

  • Sends HTTP GET requests with path traversal sequences to read files from the target serverexploits/multiple/webapps/52540.py:23-26exploits/multiple/webapps/52540.py:37
  • Checks response status code 200 and content length > 60 bytes to determine if file read was successfulexploits/multiple/webapps/52540.py:39
  • Prints a preview of the retrieved file content if successfulexploits/multiple/webapps/52540.py:40-42
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://cybir.com/2023/cve/poc-repetier-server-140/Advisory URL referenced in a comment; not fetched or executed by the script.exploits/multiple/webapps/52540.py:7
Review boundaries

What the analysis did not establish

  • The CVE context (CVE-2026-26335) describes a static machineKey vulnerability in Calero VeraSMART, but the PoC targets Repetier-Server path traversal, indicating a possible CVE mismatch in the metadata.
  • The script uses 'verify=False' in requests.get, which disables SSL certificate verification and may mask connection issues, but this does not affect classification.
  • Only the supplied text file was reviewed; no binary files or external resources were inspected.
  • The script uses 'verify=False' in requests.get, disabling TLS certificate validation, which is a security weakness but not a backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1