Requirements

• Docker + docker compose, python3, git, curl on the host.
• ~8 GB free RAM (two GitLab instances, ~4 GB each) and ~10 GB disk. First boot: 4–8 min/instance.
• Run only against these local lab instances. Authorized/defensive testing of software you control.

Run

Expected result:

Other subcommands:

How the oracle works (no HTTP-200 cheating)

Both the vulnerable and patched servers answer the malicious publish with HTTP 200 {"status":"processing"} — the file is written later, in the finalize worker. So HTTP status is not an oracle. exploit/poc.py --verify-docker <container> instead polls inside the container for the controlled file at the traversed path and compares its SHA-1:

• vulnerable → /var/tmp/CVE_2026_10053_PROOF-1.0.0.tgz appears (owner git:git, our bytes) → exit 0.
• patched → file never appears; the worker logs Gitlab::PathTraversal::PathTraversalAttackError: Invalid path → exit 2.

The exploit itself is nothing but the authenticated PUT …/packages/npm/:pkg request; the traversal lives entirely in the JSON body name (file_name = "#{name}-#{version}.tgz", only blank-checked). The docker exec calls are verification and setup, never part of the attacker's capability.

Scope

• Proven: an authenticated user (Developer+ can publish packages; this lab uses a root PAT for setup convenience) writes attacker-controlled bytes to any git-writable path. Files land 0644.
• Not proven here: RCE. The stored basename is forced to end -<semver>.tgz (NUL is rejected by the kernel, newline doesn't truncate), so no exact-name target (secrets.yml, authorized_keys, a .rb, gitaly binaries) can be overwritten. The only filename-agnostic executor, custom_hooks/<hook>.d/, runs any filename but only if executable — and this write is 0644. Overwriting a pre-existing 0755 file does not help: the store replaces the inode, resetting it to 0644. So RCE needs a separate executable-bit / execution primitive this PoC does not supply.

./run.sh rce-gate demonstrates exactly this honestly: it plants a pre-receive.d hook via the traversal, pushes, and shows the 0644 hook does not execute. ./rce_gate_demo.sh --illustrate-gate additionally sets +x via docker exec chmod (an out-of-band docker-root action, not attacker capability) purely to show gitaly would run it — underscoring that the missing lever is the exec bit.

Root cause & fix

See ANALYSIS.md for the full analysis. In short: app/uploaders/gitlab_uploader.rb validated the storage path only before :cache; at before :store the model-derived file_name (attacker-controlled, unvalidated) was written verbatim. The fix adds before :store, :protect_from_path_traversal!.

Files