Full Breakdown
Critical GitLab Path-Traversal Flaw Promptly Exploited After Patch
By Drooid · · How we work
Background & Context
CISA has identified CVE-2026-85706 as a maximum-severity path-traversal bug in GitLab’s repository-commits API. The flaw allows unauthenticated users to read arbitrary files on self-hosted GitLab Community Edition and Enterprise Edition servers. The issue affects all versions from 18.7 up to, but not including, 19.1.8; the 19.2 branch before 19.2.6; and 19.3 before 19.3.2.
Exploitation Activity
Security firm watchTowr reported probes for CVE-2026-85706 in the wild over the weekend following the release of fixes. The firm warned that widespread exploitation was likely, noting that an attacker can trigger the bug with a single HTTP request, potentially exposing local files, configuration data, credentials and other secrets. watchTowr advised operators of internet-facing self-hosted instances to apply the patch immediately or remove public access, and to audit logs for HTTP POST requests to `/api/v4/projects/{id}/repository/commits/` that contain `file.path` parameters.
Official Statements & Responses
GitLab shipped patches on September 10 in versions 19.3.2, 19.2.6 and 19.1.8, urging owners of affected self-managed installations to upgrade without delay. GitLab.com is already patched; GitLab Dedicated customers require no action. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and issued the following statement:
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” — CISA
CISA further encouraged all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV-catalog items.
Data & Statistics
- CVE ID: CVE-2026-85706
- CVSS Score: 10.0 (maximum)
- Affected Versions: 18.7-<19.1.8, 19.2-<19.2.6, 19.3-<19.3.2
- Patched Versions: 19.1.8, 19.2.6, 19.3.2 (released September 10)
What’s Next
CISA’s inclusion of the flaw in the KEV catalog signals heightened federal attention. Administrators of exposed, unpatched installations are urged to treat the upgrade as a priority task today. Ongoing monitoring for the specific POST request pattern and removal of public exposure for self-hosted GitLab instances are recommended mitigation steps.