tibbersv6/cve-2026-21440-poc-expProof-of-concept exploit for CVE-2026-21440, enabling file upload and remote command execution on Windows web servers with built-in sensitive path presets.
Complete CVE-2026-21440 Vulnerability Information
📁 Brief steps for using the CVE-2026-21440 PoC script
Install dependencies python -m pip install --upgrade pip
Run the test python CVE-2026-21440-code.py -h
6 built-in preset sensitive paths (-s for direct invocation, no need to type long paths)
Quick reference for key parameters (table version, clear and easy to understand)
| Parameter | Required / Optional | Core function | Your target example |
|---|
| -u/--url | Required | Target base URL (your screenshot target, fixed) | -u http://172.17.10.12:2324 |
| -s/--select | Optional | Select a built-in sensitive path (6 presets, enter the alias directly, no need to type the full path) | -s hosts、-s systemini |
| -f/--file | Optional | Custom verification file path (takes priority over -s, requires a full Windows path) | -f C:/Windows/System32/drivers/etc/protocols |
| --exploit | Optional | Enable exploit mode (upload Shell + remote command execution, core privilege escalation switch) | --exploit |
| --shell | Required for exploitation | Full Windows path for Shell write (must be the Web root directory, otherwise inaccessible) | --shell C:/phpstudy/WWW/shell.php |
| --pass | Optional | Shell connection password (custom, default: cve2026) | --pass myhack123 |
| --type | Optional | Shell type (adapted to Windows Web environments, default php, optional asp) | --type asp |
| --cmd | Optional | Windows command to test execution (default whoami, optional ipconfig/dir, etc.) | --cmd ipconfig |
Disclaimer
This CVE-2026-21440 proof-of-concept script is provided for educational, research, and authorized security testing purposes only.
❌ You may use it on: • Systems you own • Systems you have explicit written permission to test
❌ You must not use it for: • Unauthorized access to any system • Any form of illegal activity • Malicious purposes
The author and distributor assume no responsibility for: • Misuse of this tool • System damage • Legal consequences of unauthorized use
Using this script to attack systems without permission violates the laws of most countries (e.g., the CFAA in the US, the Computer Misuse Act in the UK).
By using this tool, you agree to: • Take full responsibility for your own actions • Comply with all applicable laws
Stay ethical. Test responsibly. Report vulnerabilities to vendors.
