1name: crowdsecurity/vpatch-CVE-2026-85706
2description: 'Detects GitLab unauthenticated arbitrary file read (CVE-2026-85706) via client-supplied file.path/file.size parameters'
3rules:
4  # Workhorse matches upload routes on the still-encoded path while Puma decodes first, so
5  # the route guard can be dodged many ways (%66iles, %63ommits, a bare trailing slash).
6  # Rails then reads the literal 'file.path' key, which only Workhorse should ever inject,
7  # so anchoring on that key rather than the encoding trick survives unpublished variants.
8  - or:
9      - and:
10          - zones:
11              - URI
12            transform:
13              - lowercase
14              - urldecode
15            match:
16              type: contains
17              value: '/api/v4/'
18          - zones:
19              - ARGS_NAMES
20            transform:
21              - lowercase
22              - urldecode
23            match:
24              type: regex
25              value: '^file\.(path|size)$'
26      - and:
27          - zones:
28              - URI
29            transform:
30              - lowercase
31              - urldecode
32            match:
33              type: contains
34              value: '/api/v4/'
35          - zones:
36              - BODY_ARGS_NAMES
37            transform:
38              - lowercase
39              - urldecode
40            match:
41              type: regex
42              value: '^file\.(path|size)$'
43
44labels:
45  type: exploit
46  service: http
47  confidence: 3
48  spoofable: 0
49  behavior: 'http:exploit'
50  label: 'GitLab - LFI'
51  classification:
52    - cve.CVE-2026-85706
53    - attack.T1190
54    - cwe.CWE-22