CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
In plain language
AI Act nowCVE-2026-85706 is a GitLab flaw that lets anyone (no login) read sensitive files from the server by using crafted requests; if your GitLab is older than 19.1.8 (or the matching newer fix versions), you should treat this as an urgent patch.
Unauthenticated path traversal in GitLab’s repository commits API can bypass path confinement and authentication enforcement under specific conditions, allowing remote attackers to read arbitrary server files; fixed in 19.1.8 / 19.2.6 / 19.3.2+.
What to do now
- Check your GitLab version and whether it is in the affected range (prior to 19.1.8, 19.2.6, or 19.3.2).
- If you are affected, upgrade GitLab to the first fixed version for your branch (19.1.8, 19.2.6, or 19.3.2).
- If you cannot upgrade immediately, follow your vendor’s mitigation guidance for this CVE right away (and confirm with your IT/security team that it is compatible with your deployment).
- After upgrading/mitigating, review access logs and confirm there were no unauthorized file reads attempts around 2026-09-11 onward.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:CScopeC:HConfidentialityI:HIntegrityA:NAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- Maximum Severity GitLab Flaw Puts Supply Chains at Risken·Dark Reading·
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkitsen·The Hacker News·
- 14th September – Threat Intelligence Reporten-us·Check Point Research· Exploited IDScan.net ShinyHunters
- Разработчики призвали срочно исправить критическую уязвимость в GitLabru-ru·Хакер (xakep.ru)· Exploited GitLab CE info-disclosure
- CISA: Hackers now exploit max severity GitLab flaw in attacksen-us·BleepingComputer· Exploited GitLab CE zero-day
- GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosureen·The Hacker News· Exploited GitLab CE web-app
- GitLab Vulnerability Exploited One Day After Disclosureen-us·SecurityWeek· Exploited GitLab CE info-disclosure
- GitLab urges users to patch max severity path traversal flawen-us·BleepingComputer· Patch GitLab CE info-disclosure
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-85706 and every CVE in our database. Create a free account — no credit card required.
Create Free Account