171 matches found
cve-2026-85706
CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...
CVE-2026-85706-gitlab-poc
CVE-2026-85706 Description GitLab CE/EE unauthenticated arbitrary file read vulnerability CVE-2026-85706. Affected versions: GitLab CE/EE 18.7 – 19.1.7 GitLab CE/EE 19.2.0 – 19.2.5 GitLab CE/EE 19.3.0 – 19.3.1 Patched versions: GitLab 19.1.8 GitLab 19.2.6 GitLab 19.3.2 Vulnerability Details The...
gitread
gitread PoC for CVE-2026-85706, an unauthenticated arbitrary file read affecting self-managed GitLab CE/EE. | ---|--- CVE| CVE-2026-85706 CVSS| 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Affected| 18.7 to 19.1.7, 19.2.0 to 19.2.5, 19.3.0 to 19.3.1 Fixed| 19.1.8 / 19.2.6 / 19.3.2 released 2026-09-10...
CVE-2021-22204-Gitlab
Gitlab-Exiftool-RCE Original repos : https://github.com/CsEnox/Gitlab-Exiftool-RCE Creds to CsEnox. RCE Exploit for Gitlab 13.10.3 GitLab Workhorse will pass any file to ExifTool. The current bug is in the DjVu module of ExifTool. Anyone with the ability to upload an image that goes through the...
cve-2026-85706-poc-exploit-gitlab
cve-2026-85706 Unauthenticated arbitrary local file read in GitLab CE/EE. Affects 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Fixed in 19.1.8 / 19.2.6 / 19.3.2 2026-09-10. CVSS 10.0, reportedly exploited in the wild. Original report by s3ntago and this repo is just my writeup + PoC. disclaimer Thi...
CVE-2026-56857 vulnerabilities
Vulnerabilities for packages: prometheus, commercial-gitlab-rails-ee-fips, kube-conformance, tempo-fips, falco-no-driver, terraform, zitadel, reports-server, cosign-fips, loki, spire-server, opentelemetry-collector-k8s, tigera-operator, omnictl-multiarch-fips, aactl, flux, commercial-chainloop-cl...
CVE-2026-85706
CVE-2026-85706: GitLab CE/EE Unauthenticated Path Traversal CVE : CVE-2026-85706, CVSS 3.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Component : GitLab CE/EE Repository Commits API Workhorse body-upload variant Affected : 18.7 ≤ version 19.1.8, 19.2.0–19.2.5, 19.3.0–19.3.1 Fixed : 19.1.8 / 19.2.6 ...
GitLabSniper
GitLabSniper CVE-2026-85706 — GitLab CE/EE unauthenticated arbitrary file read detect · public project enum · loot · interactive shell · subfinder/httpx pipeline Author: Yunus Emre Öztaş mitsec X: x.com/ynsmroztas GitHub: github.com/ynsmroztas Site: ynsmroztas.github.io Mail: [email protected]...
cve-2026-85706
cve-2026-85706 Unauthentifiziertes beliebiges lokales Dateilesen in GitLab CE/EE. Betrifft 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Behoben in 19.1.8 / 19.2.6 / 19.3.2 2026-09-10. CVSS 10.0, Berichten zufolge in freier Wildbahn ausgenutzt. Ursprünglicher Bericht von s3ntago, und dieses Repo ist...
GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...
GHSA-WR3R-JHMC-F6JW vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips...
CVE-2026-92530 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips...
GHSA-C3RM-3HQR-4QWM vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips...
CVE-2026-92874 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips...
CVE-2026-92628 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips...
Exploit for Path Traversal in Gitlab
cve-2026-85706 Unauthenticated arbitrary local file read in G...
cve-2026-85706
CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...
CVE-2026-85706
CVE-2026-85706 GitLab CE および EE における未認証のパストラバーサル / 任意ファイル読み取り。 CVSS 10.0。ローカルラボの自己管理型 19.3.1 インスタンスに対して検証済み。 影響を受けるバージョン GitLab CE/EE: 18.7 から 19.1.7 まで 19.2.0 から 19.2.5 まで 19.3.0 から 19.3.1 まで 前提条件: インスタンスに少なくとも 1 つの公開プロジェクトが存在すること。任意の実在するプロジェクト id で動作する。アカウントやトークンは不要。 仕組み create-commit エンドポイント...
Exploit for Path Traversal in Gitlab
CVE‑2026‑85706 – GitLab Unauthenticated F...
...[ More ]
This Metasploit module exploits CVE-2026-85706, an unauthenticated arbitrary file read in the GitLab repository commits and files APIs. A path parsing discrepancy between GitLab Workhorse and Rails allows unsigned upload metadata to reach the Rails handler, where an attacker-controlled local path...