CVE-2026-85706 is an improper path confinement and missing authentication vulnerability in the GitLab repository commits API. A remote unauthenticated attacker can forge Workhorse body-upload metadata and make GitLab read an arbitrary local file before authentication is enforced. This module sends a crafted form to the repository commits API and extracts file content reflected by a parser error. The request does not require a GitLab account, but PROJECT ID must identify an existing project that is available to unauthenticated users. The requested file is interpreted as URL-encoded form data and its content is returned only when parsing encounters malformed percent encoding. Ampersand and semicolon characters separate parameters, while the first equals sign separates a parameter name from its value. The error response includes only the name or value being decoded when the error occurs. The module cannot select a byte offset or resume parsing, so it may disclose only part of a file or no content at all. This exploit does not install an agent.

The Vite development server is vulnerable to arbitrary file read due to insufficient path validation when processing URL requests. This exploit sends a crafted URL request to the Vite development server, that includes the target filename combined with an specific parameter. If the server responds 200 OK, after that processes the server's Base64-encoded response through a decoding routine and displays the file contents. Optionally, the exploit can save the leaked file locally where the user defines it in the OUTPUT_PATH parameter.

A directory traversal vulnerability in SolarWinds Serv-U FTP Server allows unauthenticated remote attackers to download system files. To take advantage of this vulnerability, we need to make a request using the InternalDir and InternalFile parameters, this will allow us to trigger a directory traversal and thus be able to read an arbitrary file. This module exploits the directory traversal to download the file specified and to save it locally in the location specified in the "OUTPUT PATH" parameter.

A directory traversal vulnerability in the WebResourceServiceImpl class of org.sonatype.nexus.internal.webresources allows unauthenticated remote attackers to download any file, including system files outside of Sonatype Nexus Repository Manager application scope. This module exploits the directory traversal to download the file specified in the "FILE PATH" parameter and to save it locally in the location specified in the "OUTPUT PATH" parameter.

This module exploits a path traversal vulnerability present in the getPluginAssets function of Grafana which allows an attacker to download system files through specially crafted HTTP resource requests.

This module exploits a file disclosure vulnerability in Pulse Connect Secure SSL VPN which allows an unauthenticated attacker to download system files through specially crafted HTTP resource requests.

This module exploits a path traversal vulnerability in the FortiOS SSL VPN web portal which allows an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.

This module exploits a directory traversal vulnerability in HP Intelligent Management Center. Due to a lack of authentication and a directory traversal vulnerability in the IctDownloadServlet component, an attacker can retrieve arbitrary files.

This module exploits a directory traversal vulnerability in HP Intelligent Management Center. Due to a lack of authentication and a directory traversal vulnerability in the FaultDownloadServlet component, an attacker can retrieve arbitrary files.