GitLab Path Traversal Arbitrary File Read (CVE-2026-85706)

let traversalPatterns = dynamic(["..%2f","..%2F","%2e%2e%2f","%2e%2e/","..\\","..%5c","%252e%252e","....//","/etc/passwd","gitlab-secrets.json","secrets.yml","database.yml"]);
W3CIISLog
| union (CommonSecurityLog | extend RequestURL = RequestURL, csHost = DestinationHostName, csUriStem = RequestURL)
| where isnotempty(csUriStem)
| extend decodedUri = tolower(url_decode(csUriStem))
| where decodedUri has_any (traversalPatterns) or cs_uri_query has_any (traversalPatterns)
| where csHost has "gitlab" or sSiteName has "gitlab" or csUriStem has "/gitlab"
| project TimeGenerated, csHost, cIP, csUriStem, cs_uri_query, decodedUri, scStatus, csUserAgent
| sort by TimeGenerated desc

index=web (sourcetype="gitlab:workhorse" OR sourcetype="nginx:plus:access" OR sourcetype="access_combined")
| eval decoded_uri=urldecode(uri_path)
| where (like(lower(decoded_uri),"%..%2f%") OR like(lower(decoded_uri),"%..%5c%") OR match(decoded_uri,"(?i)(\.\.[\\/]){2,}") OR match(decoded_uri,"(?i)(etc/passwd|gitlab-secrets\.json|secrets\.yml|database\.yml)") OR match(uri_query,"(?i)%2e%2e(%2f|%5c)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(decoded_uri) as uris values(status) as statuses by src_ip host http_user_agent
| where count > 0
| sort - count

any where event.category == "web" and
  (
    stringContains(url.original, "..%2f") or
    stringContains(url.original, "..%5c") or
    stringContains(url.original, "%2e%2e%2f") or
    stringContains(url.path, "../") or
    stringContains(url.original, "gitlab-secrets.json") or
    stringContains(url.original, "/etc/passwd") or
    stringContains(url.original, "secrets.yml")
  ) and
  (stringContains(url.domain, "gitlab") or stringContains(url.path, "/gitlab"))

SELECT sourceip, destinationip, "URL" AS uri, "User Agent" AS ua, QIDNAME(qid) AS event, starttime
FROM events
WHERE (LOWER("URL") LIKE '%..%2f%' OR LOWER("URL") LIKE '%..%5c%' OR LOWER("URL") LIKE '%%2e%2e%2f%' OR LOWER("URL") LIKE '%/etc/passwd%' OR LOWER("URL") LIKE '%gitlab-secrets.json%' OR LOWER("URL") LIKE '%secrets.yml%' OR LOWER("URL") LIKE '%database.yml%')
AND (LOWER("URL") LIKE '%gitlab%' OR LOWER(payload) LIKE '%gitlab%')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*gitlab* OR _sourceCategory=*proxy*
| parse regex "(?<method>\S+)\s+(?<uri>\S+)\s+HTTP" nodrop
| tolowercase(uri) as luri
| where luri matches /(\.\.%2f|\.\.%5c|%2e%2e%2f|(\.\.[\/\\]){2,}|etc\/passwd|gitlab-secrets\.json|secrets\.yml|database\.yml)/
| count by src_ip, uri, status
| sort by _count

rule gitlab_cve_2026_85706_path_traversal {
  meta:
    author = "argus"
    cve = "CVE-2026-85706"
    severity = "CRITICAL"
    description = "GitLab path traversal arbitrary file read exploitation"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f)`) or
      re.regex($e.target.url, `(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f|(\.\.[\/\\]){2,}|etc/passwd|gitlab-secrets\.json|secrets\.yml|database\.yml)`)
    )
    $e.target.url = /(?i)gitlab/
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=HttpRequest OR #event_simpleName=NetworkConnectIP4
| lower(field=HttpPath, as=lpath)
| lpath=/(\.\.%2f|\.\.%5c|%2e%2e%2f|(\.\.[\/\\]){2,}|etc\/passwd|gitlab-secrets\.json|secrets\.yml|database\.yml)/i
| HttpHost=/gitlab/i OR HttpPath=/gitlab/i
| groupBy([aid, RemoteAddressIP4, HttpHost], function=([count(as=hits), collect([HttpPath, HttpMethod])]))
| sort(hits, order=desc)