## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GUNEYKABEL-CVE-2026-85706
# cve-2026-85706
Unauthenticated arbitrary local file read in GitLab CE/EE. Affects 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Fixed in 19.1.8 / 19.2.6 / 19.3.2 (2026-09-10). CVSS 10.0, reportedly exploited in the wild. Original report by `s3ntago` and this repo is just my writeup + PoC.
## disclaimer
This PoC is published for educational and defensive research purposes only, to help admins and researchers understand and test for the vulnerability. Run it exclusively against systems you own or have explicit written authorization to test. If your instance falls in the affected range, stop reading and patch to 19.1.8 / 19.2.6 / 19.3.2 first.
## how it works
Three repository endpoints (`POST :id/repository/commits`, `POST`/`PUT :id/repository/files/:file_path`) sit behind Workhorse's requestBodyUploader. The Rails handler reads the on-disk path straight from the raw `file.path` request field and `File.open`s it before any authentication. does not serve as an auth because Workhorse's signing round-tripper attaches a valid JWT to every request it proxies, so anything that falls through to the generic API proxy passes that check.