GitLab path-traversal flaw CVE-2026-85706 under active exploitation

October 3, 2026 at 09:27 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A critical path-traversal vulnerability in GitLab, CVE-2026-85706, is under active exploitation, allowing unauthenticated attackers to read arbitrary files from self-managed instances. The flaw affects GitLab CE/EE versions 18.7 through 19.3.1 and carries a CVSS score of 10.0. GitLab patched the issue on September 11, and CISA added it to its Known Exploited Vulnerabilities catalog.

Key Facts

CVE-2026-85706 is a critical path-traversal vulnerability in GitLab with a CVSS score of 10.0.
The vulnerability affects GitLab CE/EE versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1.
GitLab patched the vulnerability on September 11, 2026.
CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog.
Exploitation requires the GitLab instance to have at least one public project.

Vulnerability Details

CVE-2026-85706 is a path-traversal vulnerability in GitLab's repository commits API that allows unauthenticated remote attackers to read arbitrary files from the server. The flaw stems from improper path confinement and missing authentication enforcement in the repository commits API. The vulnerability affects all GitLab CE/EE versions from 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1. It carries a CVSS score of 10.0, the highest possible severity rating. Exploitation requires only that the GitLab instance have at least one public project.

Exploitation and Response

Security firm watchTowr reported that within hours of the disclosure, attackers were conducting in-the-wild probes. CISA subsequently added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog. GitLab patched the vulnerability on September 11, 2026, and backported fixes to versions 19.0.9 and 18.11 two weeks later. watchTowr recommends hunting through log files for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters. Cybersecurity executive Christopher Houser warned that patching alone is insufficient, as attackers may have already copied deploy tokens, CI variables, and SSH keys.