ceaarab/cve-2026-26336-pocProof-of-concept exploit for CVE-2026-26336, an unauthenticated path traversal in Alfresco Share allowing arbitrary file read within the webapp and co-deployed Tomcat instances.
Alfresco Share exposes a /share/page/resource/ endpoint used to serve static resources. In vulnerable versions, this endpoint does not properly restrict path traversal, allowing an unauthenticated attacker to read arbitrary files within the Share webapp (and potentially sibling webapps deployed in the same Tomcat instance).
..;/)An unauthenticated attacker can read any file within the deployed webapp:
WEB-INF/web.xml — servlet configuration, filter chains, security constraintsWEB-INF/classes/alfresco-global.properties — database credentials, LDAP bind passwords, SMTP credentialsWEB-INF/classes/alfresco/keystore/ssl.keystore — mTLS certificates used for Solr communicationWEB-INF/classes/alfresco/keystore/ssl-keystore-passwords.properties — keystore passwordsMETA-INF/MANIFEST.MF — exact version and build informationNB: If the Alfresco webapp is co-deployed in the same Tomcat, double traversal (..;/..;/alfresco/...) reaches the Alfresco WAR, exposing database credentials and keystore material.
python poc.py -t https://target.com
python poc.py -t https://target.com -f WEB-INF/classes/alfresco-global.properties
python poc.py -t https://target.com --dump
This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain written permission before testing.