PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← Back | CVE Intelligence Hub

CVE-2026-85706[Critical][Actively exploited]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-85706.

Vendor
GitLab
Product
GitLab CE/EE
Affected versions
18.7 – 19.1.7, 19.2.0 – 19.2.5, 19.3.0 – 19.3.1
CVSS
10
Exploit Status
Actively exploited
Coverage Span
2026-09-28
Reports
1 related reports

Associated Reports & Timeline

1.
GitLab CE/EE Unauthenticated Arbitrary File Read Exploit PoC (CVE-2026-85706)
github.com | vulnerability | Critical | [Actively exploited] | | Original ↗ | .md | #active-exploitation | #bug-bounty | #zero-day | #arbitrary-file-read
EQSTLab released a verified exploit PoC and lab environment for CVE-2026-85706, a critical unauthenticated arbitrary file read vulnerability (CVSS 10.0, listed in CISA KEV) in GitLab CE/EE. In affected versions, the body-upload helper for repository commits runs prior to authentication and accepts file.path without path confinement. By URL-encoding the endpoint (%63ommits) to bypass GitLab-Workhorse normalization, unauthenticated attackers targeting instances with public projects can read arbitrary host files, leaking secrets and configuration. Patched in 19.1.8, 19.2.6, and 19.3.2.
Why it matters: GitLab is widely deployed across enterprise infrastructure; a CVSS 10.0 unauthenticated file read listed in CISA KEV enables attackers to leak gitlab-secrets.json and database credentials, easily leading to full instance takeover.