# Exploitarium: Mass Public Disclosure of Unreported Zero-Day PoCs (libssh2 CVE-2026-55200, Gitea CVE-2026-20896 / CVE-2026-58053, 7-Zip, Docker, OpenVPN Connect, VLC, nmap)

> An anonymous researcher using the handle 'bikini' published 'Exploitarium', a GitHub archive of 130+ proof-of-concept exploits and write-ups that, per the author, had not been reported to vendors. Some findings later received CVEs (libssh2 CVE-2026-55200, Gitea act_runner CVE-2026-58053), and active exploitation was reported for the Gitea Docker authentication bypass CVE-2026-20896.

- **Published:** 2026-10-31T20:28:11Z
- **Last reviewed:** 2026-10-31T20:28:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4928
- **ID:** TL-2026-4928
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-55200, CVE-2026-58053, CVE-2026-20896

## Description

In late June 2026 an anonymous researcher using the handle 'bikini' published the GitHub repository 'bikini/exploitarium', described as 'a single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported.' The tl;dr sec #336 newsletter (2026-07-09) cites 130+ PoCs and write-ups targeting libssh2, Gitea, 7-Zip, Docker, OpenVPN Connect, VLC and nmap. The author invited others to report the issues and take CVE credit, and stated the material should not be abused ('I do this so to allure people into the field'). The Register (2026-06-29) reported that GitHub subsequently removed the repository.

Source counts differ. The Register and IT-Connect cite 15 affected products or projects. Hackmag lists 18 products (7-Zip, AnyDesk, curl, Docker, Firefox, FFmpeg, Ghidra, Gitea, Gogs, ImageMagick, libssh2, MyBB, Nmap, OpenVPN, PHP, QEMU, RustDesk, VLC), 31 PoC directories and 12 findings with assigned CVEs. VPNCentral reports 204 files across 35 projects. The repository snapshot reviewed showed 47+ folders and a consolidation of 12 former standalone repositories (96 tracked entries, verified 2026-06-23). Vulnerability classes include RCE, local privilege escalation, authentication bypass, out-of-bounds read/write, CSRF and chained exploits. Hackmag reports that the author used GPT-5.3 fuzzing with a 'strictly defined automated workflow'. The Register and IT-Connect instead cite GPT-5.5 Codex. Exploits were reportedly written manually, with AI assistance on RustDesk. Some community members dismissed parts of the dump as AI-generated noise.

CVE-2026-55200 (libssh2 <= 1.11.1): ssh2_transport_read() in transport.c does not enforce an upper bound on the SSH packet_length field (CWE-680). A crafted packet during the SSH handshake, before authentication, causes heap out-of-bounds write and potential RCE. NVD scoring is CVSS 3.1 8.1-8.3 and CVSS 4.0 9.2. Hackmag describes the PoC as an attacker-controlled server corrupting client memory. Fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (PR #2052) is merged on the development branch. VulnCheck credits Tristan Madani as original discoverer, and the CVE was published 2026-06-17 before the PoC appeared in Exploitarium (reported 2026-06-23). Transitive consumers such as curl, Git and PHP link libssh2.

CVE-2026-58053 (Gitea act_runner <= 0.262.0, Docker backend): the runner passes a workflow's container.options to the Docker HostConfig, forcing only the Privileged flag off while merging options such as --pid=host, --cap-add and --security-opt unchanged. This lets an authenticated workflow author escape to host root (CVSS 4.0 9.4, CVSS 3.1 9.9, CWE-269). VulnCheck cites the bikini/exploitarium gitea-act-runner-container-options-poc directory as the public PoC.

CVE-2026-20896 (Gitea official Docker image <= 1.26.2): the image defaults to REVERSE_PROXY_TRUSTED_PROXIES=*, so any source IP can impersonate users via the X-WEBAUTH-USER header when reverse-proxy authentication is enabled (CVSS 9.8, CWE-284). It is fixed in 1.26.3, and 1.26.4 is recommended. BleepingComputer reports Sysdig observed in-the-wild exploitation (a VPN-exit scanner obtained access, first seen about 13 days after the advisory) and that Singapore CSA warned of active exploitation. About 6,200 Gitea instances were reported publicly exposed. Link to Exploitarium: Detections.ai and The Register's coverage tie this CVE to the same disclosure wave, but the Exploitarium README itself, as reviewed, does not confirm that CVE-2026-20896 originates from the archive.

Evidence caveats: The Register states two flaws (CVE-2026-55200 and CVE-2026-58053) showed evidence of real-world attacks, while IT-Connect and BleepingComputer point to the Gitea authentication bypass. Detections.ai asserts 'threat actors probing within days' and attributes activity to ShinyHunters. That attribution is not corroborated by any other source and is NOT adopted here, so the actor is recorded as Unknown. No network IOCs (IPs or domains) were published in the sources reviewed, so no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1611 Escape to Host
- T1213 Data from Information Repositories
- T1090 Proxy

## Sources

- [tl;dr sec #336 - Autonomous Vulnerability Hunting, GuardDog 3.0, Are Bug Bounties Cooked?](https://tldrsec.com/p/tldr-sec-336)
- [bikini/exploitarium (GitHub)](https://github.com/bikini/exploitarium)
- [The Register - Anonymous researcher drops 0-day 'Exploitarium' repo](https://www.theregister.com/a/5263961)
- [Hackmag - Security Researcher Publishes Exploits for Dozens of 0-Day Vulnerabilities on Exploitarium](https://hackmag.com/news/exploitarium)
- [Detections.ai - Exploitarium: Mass Disclosure of Zero-Day Proof-of-Concepts](https://detections.ai/intel-exchange/019f0f4e-f158-703a-912c-ab5a6f62d8ac)
- [IT-Connect - Exploitarium: un chercheur dévoile des failles zero-day dans 15 logiciels open source](https://www.it-connect.fr/exploitarium-un-chercheur-devoile-des-failles-zero-day-dans-15-logiciels-open-source/)
- [NVD - CVE-2026-55200 (libssh2)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-55200)
- [VulnCheck - libssh2 out-of-bounds write via unchecked packet length in transport.c](https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c)
- [libssh2 PR #2052 (fix for CVE-2026-55200)](https://github.com/libssh2/libssh2/pull/2052)
- [NVD - CVE-2026-20896 (Gitea Docker image)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20896)
- [Gitea security advisory GHSA-f75j-4cw6-rmx4](https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4)
- [Gitea blog - Release of 1.26.3 and 1.26.4](https://blog.gitea.com/release-of-1.26.3-and-1.26.4/)
- [BleepingComputer - Hackers exploit critical auth bypass in Gitea Docker image](https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-in-gitea-docker-image/)
- [NVD - CVE-2026-58053 (Gitea act_runner)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58053)
- [VulnCheck - Gitea act_runner container hardening bypass via workflow container options](https://www.vulncheck.com/advisories/gitea-act-runner-container-hardening-bypass-via-workflow-container-options)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4928