{"schema":"vulnpedia.poc/1","cve":"CVE-2026-85706","generated":"2026-10-26T13:52:32.101Z","kev":{"since":"2026-09-11","ransomware":false},"epss":{"score":0.97355,"percentile":0.99897},"cvss":{"version":"3.1","score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"},"has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/82e28bb3c98f","executable":false,"sourceId":"82e28bb3c98f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"82e28bb3c98f","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/82e28bb3c98f"}],"repositoryUrl":"https://github.com/solivaquaant/CVE-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/da75df464cb0","executable":false,"sourceId":"da75df464cb0","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"da75df464cb0","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/da75df464cb0"}],"repositoryUrl":"https://github.com/ynsmroztas/GitLabSniper"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/84b2dcd8ec1d","executable":false,"sourceId":"84b2dcd8ec1d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"84b2dcd8ec1d","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/84b2dcd8ec1d"}],"repositoryUrl":"https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5f5004a7c8dc","executable":false,"sourceId":"5f5004a7c8dc","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5f5004a7c8dc","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/5f5004a7c8dc"}],"repositoryUrl":"https://github.com/plur1bu5/gitread"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/0c3aa4bc7ab2","executable":false,"sourceId":"0c3aa4bc7ab2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0c3aa4bc7ab2","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/0c3aa4bc7ab2"}],"repositoryUrl":"https://github.com/gabrielunknown/CVE-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b0cba95e136f","executable":false,"sourceId":"b0cba95e136f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b0cba95e136f","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/b0cba95e136f"}],"repositoryUrl":"https://github.com/unh00k3d/cve-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/dc7874db190a","executable":false,"sourceId":"dc7874db190a","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"dc7874db190a","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/dc7874db190a"}],"repositoryUrl":"https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/68ba55922668","executable":false,"sourceId":"68ba55922668","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"68ba55922668","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/68ba55922668"}],"repositoryUrl":"https://github.com/brigadeops32/CVE-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/da9549761de7","executable":false,"sourceId":"da9549761de7","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"da9549761de7","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/da9549761de7"}],"repositoryUrl":"https://github.com/mhtsec/CVE-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/274c09cf6d00","executable":false,"sourceId":"274c09cf6d00","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"274c09cf6d00","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/274c09cf6d00"}],"repositoryUrl":"https://github.com/guneykabel/cve-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5de428c51a2c","executable":false,"sourceId":"5de428c51a2c","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5de428c51a2c","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/5de428c51a2c"}],"repositoryUrl":"https://github.com/tc4dy/CVE-2026-85706-PoC-Toolkit"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/6309b4484804","executable":false,"sourceId":"6309b4484804","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6309b4484804","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/6309b4484804"}],"repositoryUrl":"https://github.com/EQSTLab/CVE-2026-85706"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/9994163c153a","executable":false,"sourceId":"9994163c153a","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9994163c153a","modified":"2026-09-11T00:00:00Z","url":"https://vulncheck.com/xdb/9994163c153a"}],"repositoryUrl":"https://github.com/wuyou6956-glitch/cve-2026-85706"}],"detection_sources":[{"kind":"nuclei","template":"http/cves/2026/CVE-2026-85706.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85706.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-85706%22&type=repositories","executable":false}],"poc_candidates":[{"url":"https://github.com/FlowerWitch/CVE-2026-85706_docker_exp","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706_docker_exp","modified":"2026-09-13T06:55:37Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/FlowerWitch/CVE-2026-85706_docker_exp"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-13T06:55:37Z","url":"https://github.com/FlowerWitch/CVE-2026-85706_docker_exp"}],"tags":[]},{"url":"https://github.com/guneykabel/cve-2026-85706","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1","modified":"2026-10-22T13:06:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/guneykabel/cve-2026-85706"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-22T13:06:16Z","url":"https://github.com/guneykabel/cve-2026-85706"}],"tags":[]},{"url":"https://github.com/solivaquaant/CVE-2026-85706","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read","modified":"2026-09-12T15:25:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/solivaquaant/CVE-2026-85706"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-12T15:25:41Z","url":"https://github.com/solivaquaant/CVE-2026-85706"}],"tags":[]},{"url":"https://github.com/ynsmroztas/GitLabSniper","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706 Unauthenticated File Read","modified":"2026-10-07T07:29:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/ynsmroztas/GitLabSniper"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-07T07:29:50Z","url":"https://github.com/ynsmroztas/GitLabSniper"}],"tags":[]},{"url":"https://github.com/jithinkrishnanrs/gitlab-cve-2026-85706-ioc","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection Toolkit. Detect and hunt for exploitation of the critical unauthenticated GitLab CE/EE path traversal vulnerability with IOC scanning, Sigma, Suricata/Snort, and SIEM detection rules.","modified":"2026-10-07T07:31:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/jithinkrishnanrs/gitlab-cve-2026-85706-ioc"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-07T07:31:36Z","url":"https://github.com/jithinkrishnanrs/gitlab-cve-2026-85706-ioc"}],"tags":[]},{"url":"https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"cve-2026-85706-poc-exploit-gitlab","modified":"2026-09-18T16:08:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-18T16:08:05Z","url":"https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab"}],"tags":[]},{"url":"https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"POC GitLab CE/EE unauthenticated arbitrary file read vulnerability (CVE-2026-85706).","modified":"2026-10-22T11:03:48Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-22T11:03:48Z","url":"https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc"}],"tags":[]},{"url":"https://github.com/plur1bu5/gitread","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706 · GitLab CE/EE unauthenticated file read · research PoC with oracle mode, fd enumeration, and tiered loot targeting","modified":"2026-09-23T11:12:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/plur1bu5/gitread"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-23T11:12:16Z","url":"https://github.com/plur1bu5/gitread"}],"tags":[]},{"url":"https://github.com/gabrielunknown/CVE-2026-85706","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read exploit PoC.","modified":"2026-09-14T17:28:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/gabrielunknown/CVE-2026-85706"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-14T17:28:14Z","url":"https://github.com/gabrielunknown/CVE-2026-85706"}],"tags":[]},{"url":"https://github.com/unh00k3d/cve-2026-85706","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706 — GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.","modified":"2026-10-23T12:47:08Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/unh00k3d/cve-2026-85706"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-23T12:47:08Z","url":"https://github.com/unh00k3d/cve-2026-85706"}],"tags":[]},{"url":"https://github.com/tc4dy/CVE-2026-85706-PoC-Toolkit","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"CVE-2026-85706 – GitLab Unauth File Read Toolkit (CVSS 10.0) | Red/Blue Team suite for self-managed GitLab CE/EE 18.7–19.3.1. 2 tools: Full Exploit (unauth file read, admin token, mass scan, loot, shell, stealth, SQLite/HTML/JSON output) etc., SafeChecker (version detect, audit, security headers, TLS check, MITRE). Only Use Ethically, Educ. <3","modified":"2026-10-08T20:10:11Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/tc4dy/CVE-2026-85706-PoC-Toolkit"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-08T20:10:11Z","url":"https://github.com/tc4dy/CVE-2026-85706-PoC-Toolkit"}],"tags":[]},{"url":"https://github.com/EQSTLab/CVE-2026-85706","source":"poc-in-github","sourceId":"CVE-2026-85706","description":"GitLab Unauthenticated Arbitrary File Read","modified":"2026-10-22T15:40:33Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/EQSTLab/CVE-2026-85706"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-10-22T15:40:33Z","url":"https://github.com/EQSTLab/CVE-2026-85706"}],"tags":[]},{"url":"https://github.com/wuyou6956-glitch/cve-2026-85706","source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-30T10:57:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-85706","url":"https://github.com/wuyou6956-glitch/cve-2026-85706"},{"source":"poc-in-github","sourceId":"CVE-2026-85706","modified":"2026-09-30T10:57:14Z","url":"https://github.com/wuyou6956-glitch/cve-2026-85706"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2026-85706 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-85706/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}]}