Sploitus

Exploit for CVE-2026-85706-gitlab-poc

kitploit · 2026-09-13

Exploit Code

MARKDOWN41 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GAGALTOTAL-CVE-2026-85706-GITLAB-POC
# CVE-2026-85706

## Description

GitLab CE/EE unauthenticated arbitrary file read vulnerability (CVE-2026-85706).

Affected versions:

  * GitLab CE/EE 18.7 – 19.1.7
  * GitLab CE/EE 19.2.0 – 19.2.5
  * GitLab CE/EE 19.3.0 – 19.3.1



Patched versions:

  * GitLab 19.1.8
  * GitLab 19.2.6
  * GitLab 19.3.2



## Vulnerability Details

The vulnerability exists in GitLab's Workhorse component. The workhorse regex sees an encoded path, while Puma decodes it. Rails `File.open(file.path)` is called before authentication, and urlencoded parse interpolates invalid `%`-encoding into the 400 body, causing file contents to leak.

## Features

  * Exploit the CVE-2026-85706 vulnerability
  * Arbitrary file read via URL encoding bypass
  * Support for GitLab CE/EE versions 18.7 – 19.3.1
  * TLS skip verification option
  * Concurrent request support
  * Color-coded output for better readability



## Usage

root@kitploit:~