Description
This module exploits CVE-2026-85706, an unauthenticated arbitrary file read in the GitLab repository commits and files APIs. A path parsing discrepancy between GitLab Workhorse and Rails allows unsigned upload metadata to reach the Rails handler, where an attacker-controlled local path is read before authentication.
The response disclosure is conditional. GitLab returns a fragment of file data in an error only when the file contains a percent sign that is not followed by two hexadecimal characters. URL-form delimiters can further bound the returned fragment. Files without a malformed percent sequence are read but are not returned to the attacker.
GitLab CE and EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/gitlab/file_read_cve_2026_85706msf undefined(file_read_cve_2026_85706) > show actions ...actions...msf undefined(file_read_cve_2026_85706) > set ACTION < action-name >msf undefined(file_read_cve_2026_85706) > show options ...show and set options...msf undefined(file_read_cve_2026_85706) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub