## Summary Cloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow-up operations. When that hint is replayed on the `file/url` (and `file/thumb`) routes, DBFS caches a `shareNavigatorState` containing the already-loaded share root and share row. On a later request carrying the same hint, `shareNavigator.RestoreState` repopulates `shareRoot`, and `shareNavigator.To` then **skips `Root`**. `Root` is the only place that re-checks `inventory.IsValidShare` (share expiry, remaining-download count, owner status, source-file validity) and the share password. As a result, a recipient who prewarms a context hint while access is valid can keep minting signed file URLs for already-known shared file paths for up to the context-hint TTL (`5 * 60` = 300 s) after the owner deletes the share or the share expires — plus the lifetime of any signed entity URL minted in that window. This is a **revocation / expiry bypass**, not a way to discover unknown share contents: the attacker must already have had access to the share and must know the target file URI from a prior listing. ## Root cause (verified at `26b6b10`) **1. List responses leak the hint and each file URI** — `service/explorer/response.go` populates `ListResponse.ContextHint` and `FileResponse.Path` (`f.Uri(false).String()`). **2. `file/url` and `file/thumb` accept the client-supplied hint** — `routers/router.go:631` and `:662`: ```go file.POST("url", middleware.ContextHint(), /* ... */ controllers.FileURL) file.GET("thumb", middleware.ContextHint(), /* ... */ controllers.Thumb) ``` The `file` group's only auth gate is `middleware.RequiredScopes(types.ScopeFilesRead)` — there is **no** independent share-validation middleware on this route. All share validation lives inside DBFS. **3. The middleware trusts the header verbatim** — `middleware/file.go:41`: ```go func ContextHint() gin.HandlerFunc { return func(c *gin.Context) { if c.GetHeader(dbfs.ContextHintHeader) != "" { // X-Cr-Context-Hint util.WithValue(c, dbfs.ContextHintCtxKey{}, uuid.FromStringOrNil(c.GetHeader(dbfs.ContextHintHeader))) } c.Next() } } ``` **4. DBFS restores cached navigator state on a hint hit** — `dbfs.go:745` (`ContextHintTTL = 5 * 60`, `dbfs.go:34`). On a miss it arms `PersistState`; the closure fires in `DBFS.Recycle()` at end of request. **5. Persisted share state carries the loaded `shareRoot` + `share` row** — `share_navigator.go:72`/`:85`. `RestoreState` reinstates `n.shareRoot`, `n.share`, `n.owner`, etc. **6. `Root` is the sole validity/password gate** — `share_navigator.go:114` → `inventory.IsValidShare(share)` (`inventory/share.go:227`: `IsShareExpired` checks `Expires.Before(now)` **and** `RemainDownloads <= 0`, plus owner-active and source-file checks) followed by the `share.Password` comparison. **7. `To` skips `Root` once `shareRoot` is set** — `share_navigator.go:181`: ```go func (n *shareNavigator) To(ctx context.Context, path *fs.URI) (*File, error) { if n.shareRoot == nil { // restored state => NOT nil => Root() skipped root, err := n.Root(ctx, path) ... } ... } ``` The single-file-share branch is **also** affected: it calls `latestSharedSingleFile`, which fetches `n.fileClient.GetByID(n.share.Edges.File.ID)` straight from the restored `share` with no revalidation (`share_navigator.go`). **8. A failed download hook does not block URL issuance** — `pkg/filemanager/manager/entity.go:250`: ```go if err := m.fs.ExecuteNavigatorHooks(ctx, fs.HookTypeBeforeDownload, file); err != nil { m.l.Warning("Failed to execute navigator hooks: %s", err) // logged, NOT fatal } ``` The share's `BeforeDownload` hook is `shareClient.Downloaded()` (`UpdateOneID(share.ID).AddDownloads(1).AddRemainDownloads(-1)`). Against a deleted share this update errors, but the error is only logged and the signed URL is still minted. The signed content endpoint `file/content/:id/...` is then guarded only by `middleware.SignRequired` — it does not re-check the share. ## Steps to reproduce **Setup:** one share owner; one recipient (a second free account, or anonymous if the default anon group keeps share-download). Recipient knows the share URL (and password, if any). 1. Recipient lists the valid share: ``` GET /api/v4/file?uri=<share-uri> HTTP/1.1 Host: target ``` Response includes `context_hint` and each file's `path`. 2. While the share is still valid, recipient warms the cache for a known file: ``` POST /api/v4/file/url HTTP/1.1 Host: target X-Cr-Context-Hint: <context_hint> Content-Type: application/json {"uri":["<known-shared-file-uri>"]} ``` (cache MISS → `Root` runs → `PersistState` armed → `Recycle` writes `shareNavigatorState` to KV under `navigator_state_<hint>_share`.) 3. Owner deletes the share, **or** it expires / hits zero remaining downloads. 4. Within 300 s, recipient repeats the **same** request from step 2 (same `X-Cr-Context-Hint`, same URI). (cache HIT → `RestoreState` sets `shareRoot` → `To` skips `Root` → `IsValidShare` never runs → signed entity URL returned.) 5. The signed URL serves the file content; `file/content/:id/...` validates only the signature. **Expected:** step 4 returns `ErrShareNotFound` / `ErrShareLinkExpired`. **Actual:** step 4 returns a signed, downloadable URL. ## Impact A former share recipient (including an anonymous one, under default permissions) can keep minting signed download URLs for already-known shared files for up to 300 s after the owner deletes the share or after time/download-limit expiry, plus the validity window of each signed URL minted in that period. It defeats owner revocation, time expiry, and the remaining-download limit, and bypasses password revalidation on cached state. ## Remediation - On `RestoreState`, re-run `inventory.IsValidShare` and re-compare the current `share.Password` before trusting cached `shareRoot`; or bind the cached state to an authorization version that changes on any share edit/delete/download-limit change. - Do not store authorization-sensitive share state in context-hint cache; treat the hint as a pagination/perf token only. - Invalidate `navigator_state_*` entries when a share is edited or deleted. - Treat `HookTypeBeforeDownload` failures as blocking for share-backed downloads. - Add a regression test: list + prewarm hint, delete share, then `file/url` with the same hint must fail.
PoC: YellowKey-BitLocker-CVE-2026-45585
YellowKey BitLocker recovery - bitlocker yellowkey, yellowkey bitlocker, CVE-2026-45585, yellowkey github, yellowkey vulnerability, yellowkey CVE, TPM, BitLocker recovery key backup, Windows 10/11, CLI GUI, portable audit tool. Download:🡇
PoC: Keycloak_CVE-2026-18963_PoC
This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).
PoC: CVE-2026-18963-keycloak
CVE-2026-18963
PoC: pixel-ksu-root
adb-driven KernelSU loader for stock Google Pixel: temporary kernel R/W via CVE-2026-43499 (GhostLock), then late-loads a signature-matched kernelsu.ko for the running KMI. Manager-agnostic.
PoC: CVE-2026-43914-PoC
PoC for CVE-2026-43914: Vaultwarden <1.35.4 email-2FA brute-force bypass password oracle. Stdlib-only Python.
PoC: CVE-2026-72898
Metabase SQLi
PoC: CVE-2026-19478
GitLab Code injection
PoC: CVE-2026-75604
CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing
PoC: CVE-2026-19632
CVE-2026-19632 - TranslatePress One-Day PoC
PoC: CVE-2026-56705
CVE-2026-56705 - Adminer < 5.4.3 unauthenticated RCE via MSSQL PDO DSN injection (ODBC TraceFile arbitrary file write). PoC, Docker lab and negative test included.
PoC: CVE-2026-75604-poc
CVE-2026-75604 Next.js Windows RCE poc
PoC: CVE-2026-4692-trust-me-im-in-rdm
Firefox BrowsingContext field-sync authz bypass (N-day, bug 2017643): forged PContent::CommitBrowsingContextTransaction sets InRDMPane=true from a compromised content process - parent applies it. Prerequisite primitive for privileged-UI touch-event injection.
PoC: CVE-2022-28906-POC
CVE-2022-28906 Proof of concept in Python3
PoC: CVE-2026-41551
ROS# 路径遍历漏洞(CVE-2026-41551)
PoC: cve-2022-42475-poc
Proof of Concept (PoC) for research and controlled laboratory validation of CVE-2022-42475, a critical heap-based buffer overflow vulnerability affecting the SSL-VPN service in certain versions of FortiOS.
PoC: CVE-2026-15469
CVE-2026-15469 — Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75/XE5300/WE10800 (CWE-321). Advisory, analysis & PoC methodology (EN/KO).
PoC: CVE-2026-32475-PoC
PoC for CVE-2026-32475: Elementor Pro <=4.2.1 unauthenticated file upload to RCE. Stdlib-only Python.
PoC: CVE-2026-12295-UXXS-in-my-wasm
Firefox content->parent srcdoc forge (N-day, bug 2040160): forged PDocumentChannel with SrcdocData on a non-about:srcdoc URI -> attacker HTML served at victim origin (UXSS), via mojo-port send-path injection from a compromised content process
PoC: CVE-2026-74939-escape-the-mac-n-cheese-box
Firefox content-to-parent IPDL privilege escalation (N-day, bug 2054416): forged PDocumentChannel with RemoteTypeOverride -> privilegedabout process placement, via mojo-port send-path injection from a compromised content process
PoC: CVE-2021-27876-veritas-backup
Metasploit module: Veritas Backup Exec Agent SHA-auth NDMP remote code execution (CVE-2021-27876/27877/27878)
PoC: rmg-s9180-fzg1
Root My Galaxy SM-S9180 (dm3q) S9180ZHS8FZG1 payload port - CVE-2026-43499 + KernelSU LKM
PoC: hacktivity-vulns-exploits-lab
Writeup + CVE analysis + countermeasures for the Hacktivity 'Vulnerabilities, Exploits, and Remote Access Payloads' lab (netcat shells, Metasploit, CVE-2010-1240, CVE-2004-2687).
PoC: CVE-2026-55040-Mass-Exploit
CVE-2026-55040
PoC: Project-CVE-2026-75604
A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulnerabilities. Deploys reverse shells and webshells via path traversal, with built-in target verification and proxy support for seamless integration into standard pentest workflows.
PoC: CVE-2015-3246
CVE-2015-3246
PoC: CVE-2015-5287
CVE-2015-5287
PoC: htb-labs-nexus
Hack The Box Nexus machine write-up covering reconnaissance, Gitea credential discovery, Krayin CRM exploitation via CVE-2026-38526, initial access, and privilege escalation through a vulnerable Gitea template synchronization service.
PoC: Cisco-CVE-2026-20303-More
CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20312, CVE-2026-20313
PoC: CVE-Ubiquiti
CVE-2026-77542, CVE-2026-77543, CVE-2026-77545, CVE-2026-77550, CVE-2026-77551, CVE-2026-77552, CVE-2026-77553, CVE-2026-77554, CVE-2026-77557 - Draft or TODO
PoC: CVE-2026-18431
CVE-2026-18431 - Draft or TODO
PoC: CVE-2026-8467
CVE-2026-8467 - Draft or TODO
PoC: CVE-2026-50787
Security advisory for CVE-2026-50787: uncontrolled resource consumption in e-SIC Livre CAPTCHA generation leading to remote denial of service.
PoC: solarview-ics-vulnerability-analysis
Threat model and vulnerability analysis of Contec SolarView Compact (CVE-2022-29303)
PoC: CVE-2026-72898-metabase-sqli
Detector + root-cause analysis for CVE-2026-72898 (Metabase unauthenticated SQLi via reset_password)
PoC: By-Poloss..-..CVE-2026-18080
Poc CVE-2026-18080
PoC: CVE-2026-63520
POC pre-auth RCE on Sharepoint chain
PoC: f_hid-4.14-backports
Backports of three published f_hid fixes (incl. CVE-2026-31721, CVE-2026-31606) to an EOL Linux 4.14.190 Android vendor kernel, with on-device verification records.
PoC: chrome-vuln-scanner
Check for CVE-2026-79266. A use-after-free in the DevTools component allows arbitrary code execution inside the sandbox via a malicious Chrome extension leveraging social engineering.
PoC: CVE-2026-19912-CVE-2026-19913-CVE-2026-19914
CVE-2026-19912, CVE-2026-19913, CVE-2026-19914
PoC: CVE-2026-19632-POC
PoC for CVE-2026-19632 - TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
PoC: ghostlock-infinix-hot70
Proof-of-concept kernel exploit for GhostLock (CVE-2026-43499) on the Infinix Hot 70.
PoC: CVE-2025-2945-pgAdmin-RCE
PoC for CVE-2025-2945 — pgAdmin 4 authenticated eval() injection RCE, CVSS 9.9
PoC: CVE-2026-63072
CVE-2026-63072
PoC: CVE-2026-76904
PostGIS SQL Injection GeoTools
PoC: CVE-2014-085
ZooKeeper 未授权访问漏洞（CVE-2014-085）PoC 及靶场
PoC: hdwebmobile-photo-video-reviews
WooCommerce plugin: photo & video product reviews, closing CVE-2026-12684's unauthenticated-upload vulnerability class by construction
PoC: Exploit-CVE-2026-56705
CVE-2026-56705 — Adminer < 5.4.3 Unauthenticated RCE via MSSQL PDO DSN Injection
PoC: CVE-2026-73570
Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)
PoC: vivo-root-build
vivo/iQOO 提权 so 编译（CVE-2026-43499）
PoC: CVE-2026-72530-TrueConf-Sandbox-Escape-
Este repositorio contiene una demostración educativa de la mitigación y detección para **CVE-2026-72530**, una vulnerabilidad crítica de **Code Injection y Sandbox Escape** en TrueConf Server.
PoC: CVE-2021-41773-Exploit
CVE-2021-41773 Apache HTTP Server 2.4.49 Path Traversal to RCE Exploit
PoC: cve-2026-60004
CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.
PoC: CVE-2026-68820_Mass_Exploit
CVE-2026-68820 — Mass Exploit Framework Edition.
PoC: CVE-2026-58073-check
Safely detect Veeam Service Provider Console auth bypass CVE-2026-58073
PoC: CVE-2026-18963
Nuclei template to discover Keycloak reset-credentials endpoints related to CVE-2026-18963 exposure validation.
PoC: CVE-2020-1472
CVE-2020-1472
PoC: CVE-2026-32635-Angular-XSS-Mitigation-
Demostracion educativa de mitigacion y deteccion de CVE-2026-32635: XSS en atributos i18n de Angular.
PoC: CVE-2018-16763_fuel_cms_exploit
A fuel CMS exploit based on Python for RCE mentioned in CVE-2018-16763.
PoC: CVE-2026-26211
Public disclosure for CVE-2026-26211, a stored XSS vulnerability affecting Ekushey Project Manager CRM v5.0.
PoC: keycloak-CVE-2026-18963
PoC, Dockerfile playground and root cause from patch diff analysis.
PoC: CVE-2026-17532-lab
CVE-2026-17532 Docker Lab.
PoC: Wildfire
CVE-2026-39154, Stored XSS in CometChat JS SDK
PoC: Trespasser
CVE-2026-74970, Fission site isolation bypass in Firefox WebRender
PoC: Palimpsest
CVE-2026-74945, Uninitialized heap disclosure via a crafted web font (sec-high)
PoC: SkeletonKey
CVE-2026-6765, Test only FormAutofill handlers exposed in Firefox
PoC: Revenant
CVE-2026-74943, Use after free in Firefox RasterImage (sec-high)
PoC: CVE-2026-73570
PoC for CVE-2026-73570 (Zimbra SMTP Command Injection)
PoC: EDRKiller
Use cve-2026-36425 killer edr，360 can killer
PoC: RootMyVivo
One-click root for vivo/iQOO devices on locked bootloader | CVE-2026-43499 + KernelSU
PoC: Exploit-For-CVE-2026-18963
Exploit for CVE-2026-18963 by BlackHatExploitation
PoC: CVE-2026-16348
TP-Link Archer BE800 V1 — VPN Key Injection RCE
PoC: CVE-2026-77806
CVE-2026-77806漏洞检测代码
PoC: UniBLEed
Unitree G1 RCE PoC & Scripts (CVE-2026-76639 / CVE-2026-76640) technical details at boschko.ca/g1-ble-rce/
PoC: echidna
Unlock the bootloader of any exploitable device vulnerable to CVE-2021-30327
PoC: gha-lab-227431b300
GitHub Actions workflow sandbox for CVE-2023-30628 (changelog.yml command injection)
PoC: lab-annie
Automates exploitation of CVE-2020-13160, a critical remote code execution vulnerability in AnyDesk 5.5.2.
PoC: gha-lab-5ed08d6a80
GitHub Actions workflow sandbox for CVE-2025-32953 reproduction
PoC: Explotacion-RCE-Pentesting-BlueKeep-CVE-2019-0708-
Demostración práctica y bitácora técnica de explotación de BlueKeep (CVE-2019-0708) en RDP usando Nmap y Metasploit, documentando la resolución de errores en el entorno virtual.
PoC: PoC-for-CVE-2025-46359
PoC CVE-2025-46359
PoC: CVE-2026-63039
Reproducer for CVE-2026-63039 (Apache InLong AuditAlertRule MyBatis ORDER BY SQL injection via orderField/orderType)
PoC: CVE-2026-28672
Reproducer for CVE-2026-28672 (Apache Ranger UnixUserGroupBuilder OS command injection via username in the unixusersync module)
PoC: CVE-2026-78329
Reproducer for CVE-2026-78329 (Apache Camel camel-undertow header filter strategy not applied, websocket.* injection) — Camel Spring Boot
PoC: CVE-2026-71300
Reproducer for CVE-2026-71300 (Apache Camel camel-atmosphere-websocket dispatch header injection) — Camel Spring Boot
PoC: CVE-2026-60093
Reproducer for CVE-2026-60093 (Apache Camel camel-azure-storage-datalake downloadToFile path traversal) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-66906
Reproducer for CVE-2026-66906 (Apache Camel camel-azure-storage-blob downloadBlobToFile path traversal) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-66907
Reproducer for CVE-2026-66907 (Apache Camel camel-google-storage downloadFileName path traversal) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-66908
Reproducer for CVE-2026-66908 (Apache Camel camel-platform-http-main JWT iss/aud not validated) — standalone camel-main
PoC: CVE-2026-68820-Mitigation-PoC-
Este repositorio contiene una demostración educativa de la mitigación para **CVE-2026-68820**, una vulnerabilidad crítica de tipo **Use-After-Free (UAF)** en el driver `afd.sys` de Windows.
PoC: CVE-2026-63621
Reproducer for CVE-2026-63621 (Apache Camel camel-knative structured CloudEvent header injection) — Camel Spring Boot + Camel Quarkus
PoC: CVE-2026-59230
Reproducer for CVE-2026-59230 (Apache Camel camel-mail MimeMultipart headersInline header injection) — Camel Spring Boot + Camel Quarkus
PoC: gha-lab-16bfb18428
GitHub Actions workflow sandbox for CVE-2024-45798 reproduction
PoC: CVE-2026-73570
CVE-2026-73570 PoC
PoC: CVE-2018-5803
Lab for testing CVE-2018-5803
PoC: ghostlock-k419-adapter
GhostLock (CVE-2026-43499) adapter for 4.19.152-perf+ Android kernel
PoC: CVE-2026-43499-NAM-AL00
Security research: CVE-2026-43499 GhostLock on Huawei Nova 9 NAM-AL00 (SM7325, HMOS 4.2, kernel 5.4.86-qgki)
PoC: CVE-2025-48595-Exploit
CVE-2025-48595 Android Framework Integer Overflow PoC - 优化版
PoC: CVE-2025-55182
SIMPLE EXPOIT FOR CVE-2025-55182 FOR RCE , COMMAND INJECTIONS AND OTHER VULNERABILITIES
PoC: CVE-2022-2590-analysis
Dirty COW restricted to shmem in linux kernel (CVE-2022-2590) analysis
PoC: patch-CVE-2024-55890
Patch: Sandbox escape (macOS Kernel)
PoC: patch-CVE-2024-66001
Patch: Privilege escalation (Windows Print Spooler)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free