GitLab CE/EE Unauthenticated Arbitrary File Read via Repository Commits API Workhorse Bypass

#!/usr/bin/env bash
# check_cve_2026_85706.sh — Detect CVE-2026-85706 (GitLab unauthenticated file read)
# Usage: bash check_cve_2026_85706.sh <GITLAB_BASE_URL>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

BASE_URL="${1:?Usage: $0 <GITLAB_BASE_URL>}"
BASE_URL="${BASE_URL%/}"

# Step 1: Get GitLab version
VERSION_JSON=$(curl -sk --max-time 10 "${BASE_URL}/api/v4/version" 2>/dev/null || true)
if [ -z "$VERSION_JSON" ]; then
  # Try extracting from login page if API is restricted
  VERSION_RAW=$(curl -sk --max-time 10 "${BASE_URL}/users/sign_in" 2>/dev/null | grep -oP 'gitlab_version[":]\s*["]*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
else
  VERSION_RAW=$(echo "$VERSION_JSON" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

if [ -z "$VERSION_RAW" ]; then
  echo "UNKNOWN — could not determine GitLab version at ${BASE_URL}"
  exit 2
fi

echo "Detected GitLab version: ${VERSION_RAW}"

# Step 2: Parse version components
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION_RAW"

# Step 3: Check against affected ranges
# Affected: 18.7.0–18.11.11, 19.0.0–19.0.8, 19.1.0–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1
# Fixed:    18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2+

VULNERABLE=false

if [ "$MAJOR" -eq 18 ]; then
  if [ "$MINOR" -ge 7 ] && [ "$MINOR" -le 10 ]; then
    VULNERABLE=true
  elif [ "$MINOR" -eq 11 ] && [ "$PATCH" -le 11 ]; then
    VULNERABLE=true
  fi
elif [ "$MAJOR" -eq 19 ]; then
  if [ "$MINOR" -eq 0 ] && [ "$PATCH" -le 8 ]; then
    VULNERABLE=true
  elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 7 ]; then
    VULNERABLE=true
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -le 5 ]; then
    VULNERABLE=true
  elif [ "$MINOR" -eq 3 ] && [ "$PATCH" -le 1 ]; then
    VULNERABLE=true
  fi
fi

if [ "$VULNERABLE" = true ]; then
  echo "VULNERABLE — GitLab ${VERSION_RAW} is in the affected range for CVE-2026-85706"
  echo "Fix: upgrade to 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2+"
  exit 0
else
  echo "PATCHED — GitLab ${VERSION_RAW} is not in the affected range for CVE-2026-85706"
  exit 1
fi