Exploit Database and Proof-of-Concept Archive

Classification basis

The code sends a SQL injection payload but only extracts the database version string to determine vulnerability; it does not exfiltrate data, establish a shell, or perform any post-exploitation actions. The README describes it as a 'single + mass scanner' and the script's output is limited to classification and version reporting.

Requirements

• Target must have AcyMailing component installed and the frontentityselect task accessible.cve_2026_56292_acymailing_sqli.py:7-8

Observed behavior

• Sends a GET request with a UNION SELECT version() payload in the columns parameter to the loadEntityFront endpoint.cve_2026_56292_acymailing_sqli.py:35-36cve_2026_56292_acymailing_sqli.py:61-69
• Parses the JSON response to extract a non-numeric id field as the database version string, indicating vulnerability.cve_2026_56292_acymailing_sqli.py:72-85
• Classifies responses as vulnerable, patched, error, or safe based on HTTP status and response body keywords.cve_2026_56292_acymailing_sqli.py:88-141
• Supports single target and mass scanning with multi-threading, output files for vulnerable/patched/error targets.cve_2026_56292_acymailing_sqli.py:192-205cve_2026_56292_acymailing_sqli.py:231-257

Observables

Url

Payload withheldThe vulnerable endpoint targeted by the exploit.cve_2026_56292_acymailing_sqli.py:35

Payload

Payload withheldThe SQL injection payload used to extract the database version.cve_2026_56292_acymailing_sqli.py:36

Classification basis

exploit.py is a complete, weaponized exploit that actively exercises the vulnerability to achieve remote code execution and deliver a reverse shell. It goes beyond detection by executing attacker-controlled code on the target.

Requirements

• Target running Langflow <= 1.8.1 with a public flow accessible via the build_public_tmp endpoint.README.md:15-16exploit.py:8-9
• Attacker must be able to reach the target's HTTP service (default port 7860).exploit.py:271

Observed behavior

• Authenticates to Langflow using admin credentials to obtain a JWT token.exploit.py:46-58
• Creates a new public flow or uses an existing one to obtain a valid flow_id.exploit.py:61-83
• Constructs a JSON payload containing a CustomComponent node with embedded Python code that spawns a reverse shell.exploit.py:101-186
• Sends an unauthenticated POST request to /api/v1/build_public_tmp/{flow_id}/flow with the malicious payload, triggering exec() on the server.exploit.py:193-217
• Listens for an incoming reverse shell connection and provides an interactive command shell.exploit.py:224-258

Observables

Url

Payload withheldThe target endpoint for the exploit, as described in the CVE. The operator controls the base URL via the --url argument.exploit.py:195-197

Ip

Payload withheldExample attacker IP used in documentation. The operator controls the actual callback IP via the --lhost argument.README.md:194

Command

Payload withheldExample usage of the exploit script. All parameters are provided by the operator.README.md:210-213

Classification basis

The script actively sends a crafted payload to a vulnerable endpoint to achieve remote code execution via a reverse shell, which is the definition of an exploit.

Requirements

• Target Langflow instance with a public flow IDexploit.py:9
• Attacker-controlled listener to receive reverse shellexploit.py:10-11

Observed behavior

• Constructs a reverse shell payload using os.system() with a bash TCP reverse shell commandexploit.py:16-28
• Embeds the reverse shell code inside a custom Langflow component definition in a JSON payloadexploit.py:30-83
• Sends an unauthenticated POST request to the vulnerable build_public_tmp endpoint with the malicious payloadexploit.py:85-103

Observables

Reverse Shell

Payload withheldThe exploit payload executes a reverse shell on the target, connecting back to the operator-controlled address and port provided via command-line arguments.exploit.py:19

Target Endpoint

Payload withheldThe script sends the exploit payload to this unauthenticated endpoint on the target server, which is the vulnerable endpoint described in CVE-2026-33017.exploit.py:86

Classification basis

The Python script constructs and sends a malicious payload to a vulnerable endpoint with the intent of executing arbitrary commands on the target server, which is the definition of an exploit.

Requirements

• Target FUXA server version 1.2.8 through 1.2.10 with Node-RED plugin enabled.README.md:9
• Attacker must have a listener ready to receive the reverse shell connection.CVE-2026-25938.py:15

Observed behavior

• Sends an HTTP POST request to payload withheld with a JSON payload containing a Node-RED flow that includes an exec node configured to execute a bash reverse shell command.CVE-2026-25938.py:20-74
• Prints success or failure message based on HTTP response status code (200 or 204).CVE-2026-25938.py:75-78

Observables

Reverse Shell

Payload withheldThe exploit payload sends a reverse shell to the operator's specified IP and port, which is the disclosed purpose of the PoC.CVE-2026-25938.py:54

Target Endpoint

Payload withheldThe script sends a POST request to this endpoint on the target server to deploy a malicious Node-RED flow.CVE-2026-25938.py:22

Classification basis

The artifact is a VAPT report in README.md that describes scanning and exploitation steps but contains no executable code, scripts, or configuration files. It is a technical writeup of a known vulnerability.

Requirements

• Target running vsFTPd 2.3.4 with the backdoorREADME.md:56-60
• Network access to target port 21 and port 6200README.md:60

Observed behavior

• Describes using Nmap vuln script to detect the vulnerabilityREADME.md:84-88
• Describes using Metasploit to exploit the backdoor and obtain a root Meterpreter sessionREADME.md:90-102

Observables

Artifact Type

Payload withheldThe artifact is a single README.md file containing a Vulnerability Assessment and Penetration Testing (VAPT) report. It describes steps taken by a security analyst but contains no source code, scripts, or executable payloads.README.md:1-123

Exploit Target

Payload withheldThe report describes exploiting a known backdoor in vsFTPd 2.3.4 on a Metasploitable 2 virtual machine. This is the disclosed target of the exploit, not the operator's machine.README.md:3README.md:47

Exploit Tool

Payload withheldThe report states that the vulnerability was exploited using the Metasploit Framework, a standard penetration testing tool. The operator is expected to configure and run this tool themselves.README.md:15README.md:90

Classification basis

The artifact contains a complete, multi-stage exploit implementation that exercises the CVE-2026-43499 vulnerability to achieve local privilege escalation and SELinux disablement. The README and exploitation documentation describe the full exploit chain, including UAF triggering, heap spraying, arbitrary write via rb_erase, and credential/SELinux modification. The Makefile compiles the exploit source code into an executable binary. This is not a scanner or a writeup; it is functional exploit code.

Requirements

• Local unprivileged user access to a vulnerable Linux/Android system with USB debugging enabled and ADB connection.README.md:121-125
• Kernel version must match one of the supported targets (e.g., 6.6.118-android15 for OPPO Find X8).README.md:133-135

Observed behavior

• Triggers a use-after-free on a kernel stack-allocated rt_mutex_waiter via pselect() and futex PI operations.README.md:14-20docs/exploitation.md:58-91
• Sprays the kernel heap with pipe_buffer objects to control the memory layout and reoccupy the freed waiter memory.docs/exploitation.md:19-40
• Constructs a fake rt_mutex_waiter via fd_set data to control the rb_erase() operation, achieving an arbitrary kernel write primitive.docs/exploitation.md:95-155
• Modifies the current process's cred structure to set uid/gid to 0 and grant all capabilities, and disables SELinux by setting selinux_state.enforcing to 0.README.md:27-30docs/exploitation.md:171-226
• Spawns a root shell and optionally starts a mini ADB server for continued access.README.md:147-160

Observables

Exploit Target

Payload withheldThe artifact is a local privilege escalation exploit for a specific Linux kernel vulnerability.README.md:5-8

Exploit Behavior

Payload withheldThe exploit modifies the current process's credentials to root and disables SELinux, which is standard behavior for a local privilege escalation exploit.README.md:27-30

Network Behavior

Payload withheldThe README mentions a 'miniadb listening on USB' in the output example, which is a disclosed feature for post-exploitation interaction, not a concealed backdoor.README.md:159

Classification basis

The artifact includes executable code (payload withheld) that actively calls the vulnerable functions with crafted malicious inputs to trigger the described vulnerabilities, which is the definition of an exploit. The payload withheld describes it as a 'PoC' and provides instructions to run it, confirming its purpose is to exercise the vulnerability.

Requirements

• Elixir >= 1.14 and internet connection to fetch the vulnerable html_sanitize_ex 1.5.2 dependency.README.md:24
• The vulnerable version of html_sanitize_ex (1.5.2) must be installed via mix deps.get.README.md:27

Observed behavior

• Generates a benign CSS payload and a malicious CSS payload (differing by a single ':') and calls HtmlSanitizeEx.html5/1 on both, measuring execution time to demonstrate the quadratic regex backtracking (CVE-2026-68749).poc.exs:18-25poc.exs:42-52
• Generates payloads of 2,000 and 20,000 sibling HTML elements and calls HtmlSanitizeEx.basic_html/1 on both, measuring execution time to demonstrate the quadratic traversal (CVE-2026-68750).poc.exs:31-33poc.exs:54-62
• Prints the measured timings and the ratio of attack time to benign time, showing the super-linear performance degradation.poc.exs:48-51poc.exs:58-61

Observables

File

Payload withheldThe main PoC script that generates payloads and measures execution time of the vulnerable library.poc.exs:1-76

File

Payload withheldDocumentation explaining the vulnerabilities, reproduction steps, and expected results.README.md:1-93

Classification basis

The artifact is a configuration scanner that detects vulnerable directive patterns for CVE-2026-42945. It does not send crafted HTTP requests, trigger the overflow, or execute any exploit code; it only analyzes static configuration text and reports findings.

Requirements

• Requires an nginx configuration dump (e.g., from 'nginx -T') as input.README.md:46-48

Observed behavior

• Parses nginx configuration text to identify location blocks containing a 'rewrite' directive with a '?' followed by arguments, and a subsequent directive using an unnamed capture ($1-$9).check_rewrite.py:197-282
• Reports findings with location, rewrite, and consumer directive details, along with confidence levels (high/low).check_rewrite.py:398-424
• Exits with code 0 if no vulnerable pattern found, 1 if found, 2 if parsing fails.check_rewrite.py:496-499

Observables

File

Payload withheldThe main analysis script. It reads nginx configuration text, parses it for a specific vulnerability pattern, and outputs findings to stdout or as JSON. It does not make network connections, execute external commands, or write files.check_rewrite.py:1-503

File

Payload withheldDocumentation for the tool, explaining the vulnerability, detection logic, usage, and limitations. It matches the behavior implemented in the script.README.md:1-92

Classification basis

The artifact is a README.md file that provides a detailed technical analysis of the vulnerability, the porting process, and verification results. It explicitly states the exploit binary 'payload withheld' is a 'binary delivery, source code not public' and is not included as readable text. The packet metadata confirms the binary is flagged and not analyzed, and the analysis routing classifies the artifact as 'NO_POC_CODE_IDENTIFIED'. This constitutes a writeup without executable exploit or scanner code.

Requirements

• Target device must be a vivo iQOO 11 Pro running Android 15 (PD2254B_A_15.2.12.2.W10) with vulnerable Adreno 740 GPU firmware v675.README.md:17-21
• The compiled exploit binary 'payload withheld' must be pushed to the device and executed.README.md:78-80

Observed behavior

• The exploit achieves arbitrary physical memory read/write by exploiting a GPU firmware vulnerability.README.md:9
• It bypasses SELinux by physically overwriting selinux_state.enforcing to 0.README.md:45
• It grants full capabilities to the process while keeping uid=2000 to evade a vivo root-detection watchdog.README.md:47
• The result is a root shell with full capabilities and SELinux in permissive mode.README.md:69-72

Observables

Binary File

Payload withheldThe compiled exploit payload for CVE-2025-21479, described as a binary delivery with no source code available. Its behavior cannot be analyzed from the provided evidence.README.md:107

Classification basis

The artifact is a scanner because it checks for a vulnerability (GPU process crash via WebGL context loss) without exploiting it. The README explicitly states the root cause is not public and the harness is hypothesis-driven, designed to hunt for a crash rather than deliver a payload. The HTML/JS code compiles shaders and monitors for context loss events, which is detection, not exploitation.

Requirements

• Chrome version < 148.0.7778.216 on macOS with Metal GPU supportREADME.md:11README.md:58-63

Observed behavior

• Fingerprints the browser to determine if the Chrome version is below the fixed version 148.0.7778.216cve-2026-9999-poc.html:38-47
• Compiles and draws eight curated WebGL2 shaders designed to stress the ANGLE Metal shader translatorcve-2026-9999-poc.html:90-108
• Generates and executes mutated GLSL fragment shaders in a loop, monitoring for WebGL context loss eventscve-2026-9999-poc.html:110-162
• Logs context loss events and persists crashing shader source to localStorage for later analysiscve-2026-9999-poc.html:53-55cve-2026-9999-poc.html:150-153

Observables

LocalStorage Key

Payload withheldThe harness saves a crashing shader to localStorage for later retrieval by the operator, as documented in the README.cve-2026-9999-poc.html:152

LocalStorage Key

Payload withheldThe harness saves crash event logs to localStorage for later retrieval by the operator, as documented in the README.cve-2026-9999-poc.html:61-62

Classification basis

The artifact is a mitigation tool that modifies existing software to prevent exploitation of CVE-2026-41940. It does not contain any code to exercise or trigger the vulnerability; instead, it scans for and patches vulnerable files, and removes malicious session artifacts. This matches the definition of a scanner.

Requirements

• Must be executed with root/Administrator privileges on a system running cPanel/WHM.cve_patch.cpp:131-139
• Requires OpenSSL development libraries for compilation.README.md:8

Observed behavior

• Locates cPanel/WHM Perl source files (.pm, .pl) on the system.cve_patch.cpp:650-704
• Backs up original files before modification.cve_patch.cpp:177-244
• Injects Perl subroutines (_cve_2026_41940_sanitize, _cve_2026_41940_clean) and calls to them into session and authentication functions to strip control characters and newlines from session data, user, and password variables.cve_patch.cpp:246-383
• Scans session directories and deletes files containing carriage returns, newlines, or control characters (0x00-0x1F, 0x7F).cve_patch.cpp:474-532
• Restarts cPanel, cpsrvd, and whostmgrd services after patching.cve_patch.cpp:534-591
• Verifies the patch by checking for the presence of injected sanitizer functions and a patch marker in the modified files.cve_patch.cpp:593-648

Observables

File

Payload withheldMain patch implementation that modifies local cPanel Perl files and restarts services.cve_patch.cpp:1-758

File

Payload withheldDocumentation stating the patch is an unofficial temporary fix for CVE-2026-41940.README.md:1-8

Classification basis

The primary artifact is a Python script that actively uploads a PHP web shell to a vulnerable server and executes arbitrary commands, which constitutes exploitation rather than mere detection or scanning.

Requirements

• Target must have a page containing a WPForms form with a GoDAM record field.cve_2026_14282_poc.py:33-55
• The GoDAM plugin version must be <= 1.12.2 and the save_video_file() handler must be active.README.md:8-15

Observed behavior

• Fetches a target page and parses HTML to extract WPForms form IDs and GoDAM field IDs.cve_2026_14282_poc.py:33-55
• Constructs a multipart POST request with a PHP file disguised as video/mp4 and submits it to the detected form.cve_2026_14282_poc.py:58-80
• Attempts to access the uploaded PHP shell at a predictable web-accessible path and verifies execution by checking for a marker string.cve_2026_14282_poc.py:83-96
• Executes an attacker-supplied system command via the uploaded shell and prints the output.cve_2026_14282_poc.py:164-170

Observables

Webshell

Payload withheldThe PHP payload uploaded to the target server to achieve remote code execution.cve_2026_14282_poc.py:30

Command Execution

Payload withheldThe operator-supplied command is executed on the target server via the uploaded webshell.cve_2026_14282_poc.py:164-170

Classification basis

The script actively sends crafted requests to cast multiple votes, which is the exploitation of the vulnerability, not just detection. It is described as a 'PoC' and its main purpose is to demonstrate the bypass by successfully casting votes.

Requirements

• Target must have a page containing a YOP Poll with the vulnerable plugin version (< 7.0.6).README.md:8-12
• The attacker must be able to send HTTP requests to the target WordPress site.cve_2026_14840_poc.py:38

Observed behavior

• Fetches a target page and extracts poll ID, nonce, and answer IDs from embedded JSON.cve_2026_14840_poc.py:35-67
• Sends multiple POST requests to the YOP Poll REST API endpoint with a randomly generated IP in the X-Forwarded-For header.cve_2026_14840_poc.py:70-111
• Reports the target as vulnerable if more than one vote is accepted.cve_2026_14840_poc.py:165-167

Observables

Network Endpoint

Payload withheldThe script sends vote-casting POST requests to these endpoints on the operator-specified target. This is the core of the disclosed exploit.cve_2026_14840_poc.py:92-95

Http Header

Payload withheldThe script sets a spoofed IP address in the X-Forwarded-For header for each vote request, which is the mechanism for bypassing the per-IP vote restriction.cve_2026_14840_poc.py:89

Dependency

Payload withheldStandard Python HTTP libraries required to run the PoC. No unusual or suspicious dependencies are included.requirements.txt:1-2

Classification basis

The Python script actively sends SQL injection payloads over the network to bypass authentication and log in as an arbitrary user, which constitutes exploitation, not merely detection or scanning.

Requirements

• Dovecot 2.4.0 or 3.1.0 with SQL passdb and auth_username_chars set to emptyREADME.md:20-22
• Network reachability to the IMAP/POP3/ManageSieve serviceREADME.md:76

Observed behavior

• Connects to a target IMAP or POP3 service and sends an AUTHENTICATE PLAIN command with a crafted username containing a SQL UNION SELECT payload to override the password column for a victim usercve-2026-24031-poc.py:64-72cve-2026-24031-poc.py:119-128
• Sends a detection payload (' OR '1'='1' -- ) to fingerprint the no-escape condition by checking for a 'temporary failure' responsecve-2026-24031-poc.py:75-77cve-2026-24031-poc.py:226-237
• Reports successful authentication bypass when the server returns an OK response for the injected credentialscve-2026-24031-poc.py:247-254

Observables

Network Connection

Payload withheldThe script connects to a target specified by the operator via command-line arguments (lines 172-173 of cve-2026-24031-poc.py). This is the disclosed exploit target.cve-2026-24031-poc.py:172-173

Exploit Payload

Payload withheldThe script constructs SQL injection payloads (lines 64-77) to bypass Dovecot authentication, matching the described vulnerability.cve-2026-24031-poc.py:64-77

Classification basis

The primary artifact is a scanner. The check-invisibles.py script is explicitly described as a 'CI checker' that 'exits 1 on detection' (README.md line 32). It scans files for dangerous Unicode characters and reports their locations without modifying the target or exercising a vulnerability. The clean-invisibles.py script is a sanitizer that removes dangerous characters, which is a defensive tool, not an exploit. No code in the artifact attempts to exploit CVE-2021-42574 or any other vulnerability; it only detects and cleans the presence of dangerous Unicode sequences.

Requirements

• Python 3 interpretertools/check-invisibles.py:1
• Read access to target filestools/check-invisibles.py:66-74

Observed behavior

• Scans files with specific extensions for Unicode characters in predefined dangerous rangestools/check-invisibles.py:20-28tools/check-invisibles.py:34
• Reports the file, line, column, and hex bytes of any dangerous character foundtools/check-invisibles.py:54-62
• Exits with code 1 if any dangerous characters are detected, 0 otherwisetools/check-invisibles.py:85-94
• Sanitizer removes dangerous characters and creates a backup of the original filetools/clean-invisibles.py:82-86

Observables

File Scanning Behavior

Payload withheldThis is the disclosed functionality of the PoC, acting as a CI checker.tools/check-invisibles.py:46-63tools/check-invisibles.py:85-91

File Sanitization Behavior

Payload withheldThis is the disclosed functionality of the PoC, acting as a sanitizer with forensic logging.tools/clean-invisibles.py:34-89

Network Activity

Payload withheldThe scripts operate solely on the local filesystem, reading and writing files as specified by the user-provided path argument.tools/check-invisibles.py:1-98tools/clean-invisibles.py:1-135

Classification basis

The artifact is a technical analysis document (writeup) that describes a vulnerability, its root cause, and remediation. It contains no code intended to exploit or scan for the vulnerability. The document explicitly disclaims any active exploitation or scanning.

Requirements

• An HTTP request containing terminal escape sequences must be sent to a vulnerable Boa server.README.md:61
• The resulting log file must be viewed with a terminal emulator that interprets the escape sequences.README.md:65

Observed behavior

• The writeup describes the vulnerability conceptually, showing how an unsanitized request pathname is written to an error log.README.md:133-153
• The writeup describes the patch, which introduces an escaping function to sanitize the pathname before logging.README.md:185-189
• The writeup explicitly states that no active testing, exploitation, or scanning was performed against any third-party system.README.md:33analysis/CVE-2009-4496.md:48-52

Observables

CVE ID

Payload withheldThe artifact is a documented analysis of this specific vulnerability in the Boa web server.README.md:8

REPOSITORY PURPOSE

Payload withheldThe README explicitly states the project's objective is defensive analysis, not exploitation. No active testing was performed.README.md:13-33

Classification basis

The artifact is a writeup because it provides substantive technical analysis of CVE-2026-54984, including vulnerability description, attack characteristics, affected products, and a disclosure timeline, without containing any exploit or scanner code. The author explicitly states the repository contains no PoC or technical analysis, but the assembled advisory information constitutes a writeup.

Requirements

• User interaction is required; the target must open or process attacker-supplied content (e.g., a malicious ICC color profile).README.md:55

Observed behavior

• The artifact describes the vulnerability as a heap-based buffer overflow in Mscms.dll during ICC profile parsing, allowing an out-of-bounds write that can lead to arbitrary code execution in the context of the current process.README.md:32README.md:36
• The artifact provides a table of affected Windows versions and their fixed build numbers, along with corresponding KB articles.README.md:67-82
• The artifact explicitly states it contains no proof of concept and no technical analysis.README.md:8

Observables

Disclosure

Payload withheldConfirms the artifact is a documentation-only repository with no executable exploit code.README.md:8

Classification basis

The artifact is a command-line tool that actively exploits the missing authentication on the /terminal/ws endpoint to execute arbitrary commands on the target. The README and main.go show it takes a target URL, connects via WebSocket, and runs commands (default 'uname -a', custom via -c, or interactive shell via -i). This is exploitation, not just detection or scanning.

Requirements

• Target running Marimo <0.23.0 with the /terminal/ws WebSocket endpoint exposed.README.md:14

Observed behavior

• Connects to the target WebSocket URL without authentication.cmd/cve-2026-39987/main.go:17
• Executes a default command (uname -a) or a user-specified command on the remote host via the terminal session.README.md:47-55README.md:57-66
• Supports an interactive mode that provides a live shell to the attacker.README.md:68-81

Observables

Exploit Behavior

Payload withheldThe PoC implements the advertised CVE-2026-39987 exploit by connecting to the vulnerable endpoint and running commands, which is the expected behavior for a PoC.cmd/cve-2026-39987/main.go:14-15cmd/cve-2026-39987/main.go:17-19cmd/cve-2026-39987/main.go:31-36

Dependency

Payload withheldStandard WebSocket library used for the exploit connection; no indication of malicious modification.go.mod:6

Classification basis

The Python script actively sends crafted HTTP requests to overwrite the admin account and then authenticates to confirm access, which constitutes exploitation rather than mere detection or scanning.

Requirements

• Target Krayin CRM instance (≤2.2.0 or 2.2.4) with installer endpoint accessiblepoc_cve-2026-41452.py:4

Observed behavior

• Sends a non-AJAX POST to /install/api/admin-config-setup to confirm the middleware blocks normal requestspoc_cve-2026-41452.py:57-68
• Sends an AJAX POST with X-Requested-With: XMLHttpRequest header to bypass CanInstall middleware and overwrite admin user (id=1) with attacker-supplied credentialspoc_cve-2026-41452.py:71-81
• Extracts CSRF token from /admin/login page and logs in with the overwritten credentialspoc_cve-2026-41452.py:84-103
• Accesses /admin/dashboard to confirm successful admin takeoverpoc_cve-2026-41452.py:106-116

Observables

Exploit Behavior

Payload withheldThis is the documented CVE exploit behavior; it targets the vulnerable CRM, not the PoC operator.poc_cve-2026-41452.py:71-77

Exploit Behavior

Payload withheldStandard proof-of-exploit verification; no unrelated actions.poc_cve-2026-41452.py:84-116

Classification basis

The script actively sends crafted HTTP requests to a vulnerable endpoint to write files to arbitrary locations on the server, which is the definition of an exploit. It includes verification steps to confirm successful exploitation.

Requirements

• A running, vulnerable instance of DB-GPT v0.8.1 or earlier.poc_cve-2026-73034.sh:6
• Network access to the target's /api/v1/python/file/upload endpoint.poc_cve-2026-73034.sh:35
• Docker must be installed and accessible for the verification steps.poc_cve-2026-73034.sh:63-65

Observed behavior

• Sends a normal upload request with a safe 'user-id' header as a control test.poc_cve-2026-73034.sh:42-44
• Sends an exploit request with a 'user-id' header containing directory traversal sequences to write a file to /tmp/pwned/.poc_cve-2026-73034.sh:48-50
• Sends a second exploit request to write a file to /root/.poc_cve-2026-73034.sh:55-57
• Verifies the exploit by executing commands inside the target Docker container to list and read the written files.poc_cve-2026-73034.sh:63-68
• Tests a fixed build of the application to confirm the vulnerability is patched and the exploit is blocked.poc_cve-2026-73034.sh:72-76

Observables

Vulnerability Exploit

Payload withheldThe PoC demonstrates the core vulnerability described in CVE-2026-73034 by injecting directory traversal sequences into the user-id header to write files to arbitrary locations.poc_cve-2026-73034.sh:48-50poc_cve-2026-73034.sh:55-57

Verification Command

Payload withheldThe script uses docker exec to verify that the uploaded files were written to the traversal target directories, which is standard for a PoC that validates the exploit.poc_cve-2026-73034.sh:62-68

Classification basis

The Python script sends a crafted request to trigger the vulnerability but only observes the response; it does not perform any action that exploits the metadata spoofing to achieve unauthorized access, data modification, or other impact. The README explicitly states the script 'demonstrates and verifies the primitive (leak vs. strip)' and that the practical RCE chain depends on target plugins, which this code does not implement.

Requirements

• Target must be running a vulnerable version of Apache Traffic Server (9.2.0-9.2.14 or 10.1.0-10.1.3) with a plugin that logs or acts on '@' headers.README.md:9-10

Observed behavior

• Sends a raw HTTP GET request containing '@Ats-Internal: pwned' and '@Another-At: test' headers to a specified host and port.at_headers_spoof.py:50-57
• Receives and prints the first 400 bytes of the HTTP response.at_headers_spoof.py:63-75

Observables

Network Connection

Payload withheldThe PoC connects to a target specified by the user to send a crafted HTTP request, which is the expected behavior for a vulnerability demonstration.at_headers_spoof.py:59-61

Http Request

Payload withheldThe script constructs and sends an HTTP request containing the spoofed internal headers to trigger the vulnerability.at_headers_spoof.py:50-57