Exploit for CVE-2026-85706

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BRIGADEOPS32-CVE-2026-85706
# CVE-2026-85706

Unauthenticated path traversal / arbitrary file read in GitLab CE and EE. CVSS 10.0. Verified against a self-managed 19.3.1 instance in a local lab.

## Affected

GitLab CE/EE:

  * 18.7 up to 19.1.7
  * 19.2.0 up to 19.2.5
  * 19.3.0 up to 19.3.1



Precondition: the instance has at least one public project. Any real project id works. No account or token needed.

## How it works

The create-commit endpoint `POST /api/v4/projects/:id/repository/commits` accepts large file bodies, so Workhorse buffers the request body to disk and injects `file.path` / `file.size` metadata for Rails to read back. Four mistakes line up:

  1. The route only checks `require_gitlab_workhorse!` at entry. The real `authenticate!` sits behind `authorize_push_to_branch!`, which runs after the file read.