CVE-2026-27884
MEDIUMNetExec < 1.5.1 - Path Traversal and Arbitrary File Write via SMB Share Filename
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-27884. PoCs published by XiaomingX, RaynLight.
AI-analyzed exploit summary This PoC sets up a malicious SMB server to exploit CVE-2026-27884, an arbitrary file write vulnerability in spider_plus. It patches Impacket's SMB server to bypass file jail checks and creates a traversal payload to demonstrate the vulnerability.
Description
NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as `../` in them. An attacker can craft a filename in an SMB share that includes these characters, which when spider_plus crawls and downloads, can write or overwrite arbitrary files. The issue is patched in v1.5.1. As a workaround, do not run spider_plus with DOWNLOAD=true against targets.
Exploits (2)
This PoC sets up a malicious SMB server to exploit CVE-2026-27884, an arbitrary file write vulnerability in spider_plus. It patches Impacket's SMB server to bypass file jail checks and creates a traversal payload to demonstrate the vulnerability.
This repository contains a functional exploit PoC for CVE-2026-27884, which leverages a malicious SMB server to exploit an arbitrary file write vulnerability in the spider_plus module. The exploit bypasses file traversal restrictions by patching the `isInFileJail` function and demonstrates the vulnerability by writing a payload to a target file.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N