{"id":380,"date":"2026-10-22T10:19:15","date_gmt":"2026-10-22T02:19:15","guid":{"rendered":"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/"},"modified":"2026-10-22T10:37:22","modified_gmt":"2026-10-22T02:37:22","slug":"qgg-kb-20261020-009","status":"publish","type":"post","link":"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/","title":{"rendered":"REST API\uff5cLeaking File Contents with a Blind File Oracle in Flarum"},"content":{"rendered":"<style>\n.qgg-lead{font-size:17px;line-height:1.9;color:#333}\n.qgg-meta{margin:14px 0 18px}\n.qgg-badge{display:inline-block;padding:2px 10px;margin:0 6px 6px 0;border-radius:12px;\nbackground:#eef3ff;color:#2f56d6;font-size:13px;font-weight:600}\n.qgg-toc{background:#f7f9fc;border:1px solid #e6ecf5;border-radius:10px;padding:14px 20px;margin:22px 0 28px}\n.qgg-toc-title{font-weight:700;color:#1f2d3d;margin-bottom:8px}\n.qgg-toc ol{margin:0;padding-left:20px}\n.qgg-toc li{margin:4px 0}\n.qgg-toc a{color:#2f56d6;text-decoration:none}\n.qgg-list li{margin:7px 0;line-height:1.85;color:#2c3e50}\n.qgg-code{background:#0f172a;color:#e2e8f0;padding:16px 18px;border-radius:10px;overflow-x:auto;\nfont-size:13px;line-height:1.65;position:relative}\n.qgg-code[data-lang]:not([data-lang=\"\"])::before{content:attr(data-lang);position:absolute;\ntop:0;right:0;background:#1e293b;color:#94a3b8;font-size:11px;padding:2px 10px;border-radius:0 10px 0 8px}\n.qgg-inline-code{background:#eef2f7;color:#c7254e;padding:2px 6px;border-radius:4px;font-size:90%}\n.qgg-table-wrap{overflow-x:auto;margin:18px 0}\n.qgg-table{width:100%;border-collapse:collapse;font-size:14px}\n.qgg-table th{background:#f2f6ff;color:#1f2d3d;text-align:left;padding:10px 12px;border:1px solid #e3eaf5}\n.qgg-table td{padding:9px 12px;border:1px solid #e8eef7}\n.qgg-table tr:nth-child(even) td{background:#fafcff}\n.qgg-callout{background:#eef7ff;border-left:4px solid #3b82f6;border-radius:0 8px 8px 0;\npadding:14px 18px;margin:18px 0}\n.qgg-callout-warn{background:#fff7ed;border-left-color:#f59e0b}\n.qgg-callout-t{display:block;font-weight:700;color:#1e40af;margin-bottom:6px}\n.qgg-quote{border-left:4px solid #cbd5e1;color:#475569;margin:16px 0;padding:8px 16px}\nh2{margin-top:38px;padding-bottom:8px;border-bottom:2px solid #eef2f7;font-size:22px}\nh3{margin-top:26px;font-size:18px}\nfigure{margin:20px 0;text-align:center}\nfigure img{border-radius:10px;max-width:100%;height:auto}\nfigcaption{font-size:12px;color:#94a3b8;margin-top:8px}\n.qgg-footer{font-size:12px;color:#9aa5b1;margin-top:26px}\n<\/style>\n<p>Introduction Flarum is a free, open source PHP-based forum software used for everything from gaming hobbyist sites to cryptocurrency discussion. A quick survey on Shodan suggests there are over 1200 installs exposed to the internet. Through our research we were able to leak the contents of arbitrary local files in Flarum through a blind oracle, and conduct blind SSRF attacks with only a basic user<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\"   class=\"lazyload\" data-src=\"https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg\" src=\"https:\/\/cdn.jsdelivr.net\/gh\/moezx\/cdn@3.0.2\/img\/svg\/loader\/trans.ajax-spinner-preloader.svg\" onerror=\"imgError(this)\"  alt=\"Leaking File Contents with a Blind File Oracle in Flarum\" \/><figcaption>\u539f\u6587\u914d\u56fe\uff08\u6765\u6e90\uff1ahttps:\/\/blog.assetnote.io\/2023\/08\/28\/leaking-file-contents-with-a-blind-file-ora\uff09<\/figcaption><\/figure >\n<noscript><img decoding=\"async\" src=\"https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg\" alt=\"Leaking File Contents with a Blind File Oracle in Flarum\" \/><figcaption>\u539f\u6587\u914d\u56fe\uff08\u6765\u6e90\uff1ahttps:\/\/blog.assetnote.io\/2023\/08\/28\/leaking-file-contents-with-a-blind-file-ora\uff09<\/figcaption><\/figure><\/noscript>\n<div class=\"qgg-meta\"><span class=\"qgg-badge\">REST API<\/span> <span class=\"qgg-badge\">\u8bc4\u5206 70.0<\/span> <span class=\"qgg-badge\">\u72b6\u6001 candidate<\/span> <span class=\"qgg-badge\">QGG-KB-20261020-009<\/span><\/div>\n<nav class=\"qgg-toc\">\n<div class=\"qgg-toc-title\">\u672c\u6587\u76ee\u5f55<\/div>\n<ol>\n<li><a href=\"#sec1\" target=\"_blank\"  rel=\"nofollow\" >\u6838\u5fc3\u601d\u8def<\/a><\/li>\n<li><a href=\"#sec2\" target=\"_blank\"  rel=\"nofollow\" >\u6210\u7acb\u6761\u4ef6<\/a><\/li>\n<li><a href=\"#sec3\" target=\"_blank\"  rel=\"nofollow\" >\u9a8c\u8bc1\u65b9\u6cd5\u4e0e\u6b65\u9aa4<\/a><\/li>\n<li><a href=\"#sec4\" target=\"_blank\"  rel=\"nofollow\" >\u8bef\u62a5\u6392\u9664<\/a><\/li>\n<li><a href=\"#sec5\" target=\"_blank\"  rel=\"nofollow\" >\u5f71\u54cd\u4e0e\u4fee\u590d<\/a><\/li>\n<li><a href=\"#sec6\" target=\"_blank\"  rel=\"nofollow\" >\u539f\u59cb\u6765\u6e90<\/a><\/li>\n<\/ol>\n<\/nav>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_50 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\">\u76ee\u5f55<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\" role=\"button\"><label for=\"item-6ad99d321ea7f\" aria-hidden=\"true\"><span style=\"display: flex;align-items: center;width: 35px;height: 30px;justify-content: center;direction:ltr;\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/label><input  type=\"checkbox\" id=\"item-6ad99d321ea7f\"><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/#%E4%B8%80%E3%80%81%E6%A0%B8%E5%BF%83%E6%80%9D%E8%B7%AF\" title=\"\u4e00\u3001\u6838\u5fc3\u601d\u8def\">\u4e00\u3001\u6838\u5fc3\u601d\u8def<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/#%E4%BA%8C%E3%80%81%E6%88%90%E7%AB%8B%E6%9D%A1%E4%BB%B6\" title=\"\u4e8c\u3001\u6210\u7acb\u6761\u4ef6\">\u4e8c\u3001\u6210\u7acb\u6761\u4ef6<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/#%E4%B8%89%E3%80%81%E9%AA%8C%E8%AF%81%E6%96%B9%E6%B3%95%E4%B8%8E%E6%AD%A5%E9%AA%A4\" title=\"\u4e09\u3001\u9a8c\u8bc1\u65b9\u6cd5\u4e0e\u6b65\u9aa4\">\u4e09\u3001\u9a8c\u8bc1\u65b9\u6cd5\u4e0e\u6b65\u9aa4<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/#%E5%9B%9B%E3%80%81%E8%AF%AF%E6%8A%A5%E6%8E%92%E9%99%A4\" title=\"\u56db\u3001\u8bef\u62a5\u6392\u9664\">\u56db\u3001\u8bef\u62a5\u6392\u9664<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/#%E4%BA%94%E3%80%81%E5%BD%B1%E5%93%8D%E4%B8%8E%E4%BF%AE%E5%A4%8D\" title=\"\u4e94\u3001\u5f71\u54cd\u4e0e\u4fee\u590d\">\u4e94\u3001\u5f71\u54cd\u4e0e\u4fee\u590d<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.qgg4588.cn\/index.php\/2026\/10\/22\/qgg-kb-20261020-009\/#%E5%85%AD%E3%80%81%E5%8E%9F%E5%A7%8B%E6%9D%A5%E6%BA%90\" title=\"\u516d\u3001\u539f\u59cb\u6765\u6e90\">\u516d\u3001\u539f\u59cb\u6765\u6e90<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"sec1\"><span class=\"ez-toc-section\" id=\"%E4%B8%80%E3%80%81%E6%A0%B8%E5%BF%83%E6%80%9D%E8%B7%AF\"><\/span>\u4e00\u3001\u6838\u5fc3\u601d\u8def<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul class=\"qgg-list\">\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u53c2\u6570\u89d2\u8272\u6807\u6ce8\uff1a\u5bf9\u8c61\u6807\u8bc6(orderId)\/\u51ed\u8bc1(codeId\/uuid)\/\u7b7e\u540d\/\u72b6\u6001\uff0c\u9010\u4e2a\u6807\u6e05<\/li>\n<li>\u6765\u6e90\u94fe\u63a5: https:\/\/blog.assetnote.io\/2023\/08\/28\/leaking-file-contents-with-a-blind-file-oracle-in-flarum\/<\/li>\n<li>\u5206\u7c7b\u547d\u4e2d\u8bcd: {'REST API': ['api endpoint'], 'File Upload': ['file upload'], 'Information Disclosure': ['exposed'], 'SSRF': ['ssrf']}<\/li>\n<\/ul>\n<div class=\"qgg-callout\"><span class=\"qgg-callout-t\">\u843d\u5230 QGG \u600e\u4e48\u7528<\/span><\/p>\n<p>\u53ef\u76f4\u63a5\u843d\u5230 QGG \u7684\u300cREST API\u300d\u6d4b\u8bd5\u6e05\u5355\uff1a\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u53c2\u6570\u89d2\u8272\u6807\u6ce8\uff1a\u5bf9\u8c61\u6807\u8bc6(orderId)\/\u51ed\u8bc1(codeId\/uuid)\/\u7b7e\u540d\/\u72b6\u6001\uff0c\u9010\u4e2a\u6807\u6e05\uff1b\u4ec5\u53ef\u751f\u6210\u4eba\u5de5\u6838\u67e5\u6e05\u5355\uff08\u7f3a\u8bf7\u6c42\u7ea7\u8bc1\u636e\uff0c\u7981\u81ea\u52a8\u751f\u6210\u751f\u4ea7\u6a21\u677f\uff09<\/p>\n<\/div>\n<h2 id=\"sec2\"><span class=\"ez-toc-section\" id=\"%E4%BA%8C%E3%80%81%E6%88%90%E7%AB%8B%E6%9D%A1%E4%BB%B6\"><\/span>\u4e8c\u3001\u6210\u7acb\u6761\u4ef6<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul class=\"qgg-list\">\n<li>\u3010\u6765\u6e90\u539f\u6587\u7247\u6bb5\u3011his means that authenticated routes are also interesting, as long as they don\u2019t require administrative permissions. We quickly figured out that files called routes.php in di<\/li>\n<li>\u3010\u6765\u6e90\u539f\u6587\u7247\u6bb5\u3011his means that authenticated routes are also interesting, as long as they don\u2019t require administrative permissions.We quickly figured out that files called routes.php in dif<\/li>\n<\/ul>\n<h2 id=\"sec3\"><span class=\"ez-toc-section\" id=\"%E4%B8%89%E3%80%81%E9%AA%8C%E8%AF%81%E6%96%B9%E6%B3%95%E4%B8%8E%E6%AD%A5%E9%AA%A4\"><\/span>\u4e09\u3001\u9a8c\u8bc1\u65b9\u6cd5\u4e0e\u6b65\u9aa4<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul class=\"qgg-list\">\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u53c2\u6570\u89d2\u8272\u6807\u6ce8\uff1a\u5bf9\u8c61\u6807\u8bc6(orderId)\/\u51ed\u8bc1(codeId\/uuid)\/\u7b7e\u540d\/\u72b6\u6001\uff0c\u9010\u4e2a\u6807\u6e05<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u5355\u53c2\u6570\u6d88\u878d\uff1a\u5220\/\u7a7a\/\u9519\u7c7b\u578b\/\u91cd\u590d\u53c2\u6570\uff0c\u8bb0\u5f55\u9519\u8bef\u6587\u6848\u5dee\u5f02\uff0c\u5efa\u7acb'\u4ec0\u4e48\u662f\u5fc5\u9700'\u57fa\u7ebf<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u53c2\u6570\u4e92\u4e32\uff1a\u628a A \u53c2\u6570\u7684\u503c\u585e\u8fdb B \u53c2\u6570\u7684\u69fd\u4f4d\uff08codeId=orderId\uff09\uff1b\u518d\u8bd5 A=B \u540c\u65f6\u540c\u6b65\u9012\u589e<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u5173\u7cfb\u5224\u5b9a\uff1a\u53ea\u6539\u4e00\u4e2a vs \u4e24\u4e2a\u540c\u6b65\u6539\uff0c\u7ed3\u679c\u5dee\u5f02\u8bf4\u660e\u6821\u9a8c\u662f'\u9010\u4e2a\u6821\u9a8c'\u8fd8\u662f'\u5173\u7cfb\u6821\u9a8c'<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u51ed\u8bc1\u5f3a\u5ea6\uff1aUUID \u662f\u5426\u51fa\u73b0\u5728 JS\/\u5176\u4ed6\u63a5\u53e3\/\u54cd\u5e94\u91cc\uff08\u6cc4\u9732\u5373\u7b49\u4e8e\u65e0\u51ed\u8bc1\uff09<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u3010\u591a\u53c2\u6570\u8054\u5408\u6821\u9a8c\u5931\u6548\uff08\u53c2\u6570\u4e92\u4e32\/\u51ed\u8bc1\u81ea\u8bc1\uff09\u3011\u679a\u4e3e\u53ef\u884c\u6027\uff1a\u5bf9\u8c61 ID \u662f\u5426\u987a\u5e8f\/\u81ea\u589e\/\u65f6\u95f4\u6233\uff1b\u53ea\u8bfb 1-2 \u6761\u4ed6\u4eba\u5b9e\u8bc1\u5373\u6b62<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u5165\u53e3\u53d1\u73b0\uff1a\u4ece JS\/\u8def\u7531\/\u6d41\u91cf\/\u5386\u53f2\u8def\u5f84\u4ea4\u53c9\u786e\u8ba4\u8be5\u6f0f\u6d1e\u7c7b\u522b\u7684\u8f93\u5165\u9762\uff0c\u5355\u4e00\u6837\u672c\u4e0d\u4e0b\u7ed3\u8bba<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u524d\u7f6e\u6761\u4ef6\uff1a\u8bb0\u5f55\u8ba4\u8bc1\u72b6\u6001\u3001\u89d2\u8272\u3001\u6570\u636e\u6240\u6709\u6743\u3001\u7ec4\u4ef6\u4e0e\u7248\u672c<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u6d4b\u8bd5\u53d8\u91cf\uff1a\u53c2\u6570\u4f4d\u7f6e\u3001\u5bf9\u8c61\u6807\u8bc6\u3001\u65b9\u6cd5\u3001\u8bf7\u6c42\u5934\u3001\u6570\u636e\u683c\u5f0f\u3001\u72b6\u6001\u5207\u6362<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u6210\u529f\u8bc1\u636e\uff1a\u771f\u5b9e\u6570\u636e\u8bfb\u53d6\/\u547d\u4ee4\u6267\u884c\u56de\u663e\/\u72b6\u6001\u771f\u5b9e\u53d8\u66f4\uff08\u53ef\u590d\u73b0\uff0c\u5e26\u539f\u59cb\u62a5\u6587\uff09<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u8bef\u62a5\u8fc7\u6ee4\uff1a\u767b\u5f55\u8df3\u8f6c\u3001\u7edf\u4e00\u9519\u8bef\u9875\u3001WAF \u963b\u65ad\u9875\u3001\u7f13\u5b58\u5185\u5bb9\u3001\u901a\u7528 200\u3001\u975e\u786e\u5b9a\u6027\u5b57\u6bb5<\/li>\n<li>\u3010\u65b9\u6cd5\u6a21\u677f\u00b7\u975e\u6765\u6e90\u539f\u6587\u3011\u5f71\u54cd\u786e\u8ba4\uff1a\u53ea\u8bfb\u8bc1\u660e\u4f18\u5148\uff1b\u5199\u64cd\u4f5c\u4ec5\u5728\u81ea\u5efa canary \u5bf9\u8c61\u4e0a\u505a\u4e00\u6b21\u6700\u5c0f\u9a8c\u8bc1<\/li>\n<\/ul>\n<p>\u3010\u7f3a\u5931\u3011\u6765\u6e90\u672a\u7ed9\u51fa\u53ef\u6267\u884c\u590d\u73b0\u6b65\u9aa4\uff1b\u9700\u6309 test_methodology \u5728\u6388\u6743\u9776\u573a\u81ea\u884c\u8bbe\u8ba1\u5e76\u8bb0\u5f55<\/p>\n<h2 id=\"sec4\"><span class=\"ez-toc-section\" id=\"%E5%9B%9B%E3%80%81%E8%AF%AF%E6%8A%A5%E6%8E%92%E9%99%A4\"><\/span>\u56db\u3001\u8bef\u62a5\u6392\u9664<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul class=\"qgg-list\">\n<li>\u3010\u6765\u6e90\u539f\u6587\u7247\u6bb5\u3011Path($this-&gt;data); \/\/ isBase64 has to be after isFilePath to prevent false positives case $this-&gt;isBase64(): return $this-&gt;initFromBinary<\/li>\n<li>\u3010\u6765\u6e90\u539f\u6587\u7247\u6bb5\u3011got no response. If you are using this library, the best way to ensure you are not vulnerable is by never passing user data directly into the constructor; if you are wanting<\/li>\n<\/ul>\n<div class=\"qgg-callout qgg-callout-warn\"><span class=\"qgg-callout-t\">\u53cd\u5411\u8bc1\u636e<\/span><\/p>\n<ul class=\"qgg-list\">\n<li>Path($this-&gt;data); \/\/ isBase64 has to be after isFilePath to prevent false positives case $this-&gt;isBase64(): return $this-&gt;initFromBinary<\/li>\n<li>got no response. If you are using this library, the best way to ensure you are not vulnerable is by never passing user data directly into the constructor; if you are wanting<\/li>\n<\/ul>\n<\/div>\n<h2 id=\"sec5\"><span class=\"ez-toc-section\" id=\"%E4%BA%94%E3%80%81%E5%BD%B1%E5%93%8D%E4%B8%8E%E4%BF%AE%E5%A4%8D\"><\/span>\u4e94\u3001\u5f71\u54cd\u4e0e\u4fee\u590d<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>\u5f71\u54cd\uff1a<\/strong><\/p>\n<p>\u5206\u7c7b\uff1aREST API\uff1b\u6765\u6e90\u4e25\u91cd\u6027\uff1a\u672a\u63d0\u4f9b\u3002\u5b9e\u9645\u5f71\u54cd\u9700\u4ee5\u672c\u5730\/\u6388\u6743\u9776\u573a\u590d\u73b0\u7ed3\u679c\u4e3a\u51c6\uff0c\u8bc4\u5206\u4e0e\u6765\u6e90\u81ea\u8ff0\u4e0d\u6784\u6210\u5f71\u54cd\u7ed3\u8bba\u3002<\/p>\n<p><strong>\u4fee\u590d\uff1a<\/strong><\/p>\n<p>\u6309\u8be5\u7c7b\u6f0f\u6d1e\u7684\u901a\u7528\u6839\u56e0\u4fee\u590d\uff08\u670d\u52a1\u7aef\u6821\u9a8c\/\u767d\u540d\u5355\/\u6700\u5c0f\u6743\u9650\uff09\uff0c\u5e76\u8865\u5145\u56de\u5f52\u6d4b\u8bd5\u3002<\/p>\n<p><strong>\u5173\u8054\uff1a<\/strong>CVE-2023-40033<\/p>\n<h2 id=\"sec6\"><span class=\"ez-toc-section\" id=\"%E5%85%AD%E3%80%81%E5%8E%9F%E5%A7%8B%E6%9D%A5%E6%BA%90\"><\/span>\u516d\u3001\u539f\u59cb\u6765\u6e90<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a href=\"https:\/\/blog.assetnote.io\/2023\/08\/28\/leaking-file-contents-with-a-blind-file-oracle-in-flarum\/\" target=\"_blank\" rel=\"noopener\" rel=\"nofollow\" >https:\/\/blog.assetnote.io\/2023\/08\/28\/leaking-file-contents-with-a-blind-file-oracle-in-flarum\/<\/a><\/p>\n<hr \/>\n<p class=\"qgg-footer\">\u672c\u6587\u7531 QGG \u6e17\u900f\u5927\u5e08\u81ea\u52a8\u5b66\u4e60\u6574\u7406\uff1a\u5185\u5bb9\u53d6\u81ea\u516c\u5f00\u62a5\u544a\uff0c\u672a\u5728\u672a\u6388\u6743\u76ee\u6807\u4e0a\u505a\u4efb\u4f55\u9a8c\u8bc1\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Flarum is a free, open source PHP-based forum software used for ","protected":false},"author":0,"featured_media":429,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[25,10,24,9],"class_list":["post-380","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-","tag-cve-2023-40033","tag-qgg","tag-rest-api","tag-9"],"featured_image_urls":{"full":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",439,460,false],"thumbnail":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",143,150,false],"medium":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",286,300,false],"medium_large":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",439,460,false],"large":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",439,460,false],"1536x1536":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",439,460,false],"2048x2048":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",439,460,false],"post-thumbnail":["https:\/\/www.qgg4588.cn\/wp-content\/uploads\/2026\/10\/qgg-20261022-qgg-kb-20261020-009-img1.jpg",143,150,false]},"post_excerpt_stackable":"<p>Introduction Flarum is a free, open source PHP-based forum software used for ","category_list":"<a href=\"https:\/\/www.qgg4588.cn\/ai-%e6%bc%8f%e6%b4%9e%e5%ad%a6%e4%b9%a0\/\" rel=\"category tag\">AI \u6f0f\u6d1e\u5b66\u4e60<\/a>","author_info":{"name":"","url":"https:\/\/www.qgg4588.cn\/index.php\/author\/"},"comments_num":"0 comments","_links":{"self":[{"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/posts\/380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/comments?post=380"}],"version-history":[{"count":1,"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/posts\/380\/revisions"}],"predecessor-version":[{"id":430,"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/posts\/380\/revisions\/430"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/media\/429"}],"wp:attachment":[{"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/media?parent=380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/categories?post=380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.qgg4588.cn\/index.php\/wp-json\/wp\/v2\/tags?post=380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}