GitLab releases patches for critical 10.0 CVSS path traversal flaw CVE-2026-85706

September 14, 2026 at 04:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

GitLab released patches for CVE-2026-85706, a critical path traversal vulnerability scoring 10.0 on CVSS that allows unauthenticated attackers to read arbitrary files. The flaw affects GitLab CE and EE versions 18.7 through 19.1.7, 19.2–19.2.5, and 19.3–19.3.1. Exploitation attempts began within hours of disclosure, with scanning activity observed since September 11, 2026.

Key Facts

CVE-2026-85706 is a path traversal vulnerability in the repository commits API with a CVSS score of 10.0.
The flaw affects GitLab CE and EE versions 18.7 through 19.1.7, 19.2–19.2.5, and 19.3–19.3.1.
Exploitation requires no credentials and succeeds if at least one public project exists on the instance.
Scanning for vulnerable servers has been observed since September 11, 2026, with first exploitation attempts within hours of disclosure.
Patches are included in GitLab 19.3.2, 19.2.6, and 19.1.8; GitLab.com is already patched.

Vulnerability Details

CVE-2026-85706 is a path traversal flaw in the repository commits API caused by improper path restrictions and missing authentication checks. The vulnerability received a maximum CVSS score of 10.0 and allows unauthenticated attackers to read arbitrary files on the server. According to watchTowr, exploitation requires only that at least one public project exists on the vulnerable instance. Successful attacks can expose GitLab logs and configuration files containing credentials, tokens, and secrets.

Affected Versions and Patches

The flaw affects GitLab Community Edition and Enterprise Edition versions 18.7 through 19.1.7, 19.2–19.2.5, and 19.3–19.3.1. GitLab released fixes in versions 19.3.2, 19.2.6, and 19.1.8. GitLab.com is already running a patched version, and GitLab Dedicated users require no additional action. Administrators of self-managed instances are advised to apply patches immediately or restrict public access and monitor logs for suspicious POST requests to /api/v4/projects/{id}/repository/commits/ with file.path parameters.

Exploitation Activity

Researchers observed scanning for vulnerable servers starting September 11, 2026. First exploitation attempts began within hours of public disclosure of the vulnerability. Experts warn that mass exploitation could occur very quickly. Simultaneously, GitLab patched CVE-2026-87719, a 9.9 CVSS flaw in GitLab EE involving unsafe deserialization in GraphQL subscriptions.