Full Report
A vulnerability has been discovered in GitLab, which could allow disclosure of sensitive data. GitLab GitLab is a DevOps platform that provides source code management, CI/CD pipelines, issue tracking, and collaboration tools in a single application for software development teams. Successful exploitation of this vulnerability could allow for path traversal, leading to disclosure of potentially sensitive information such SSH keys, database credentials, deploy tokens. Depending on the sensitive information retrieved via this technique, the attacker may gain further access to the appliance or systems.
Analysis Summary
# Vulnerability: GitLab Path Traversal and Sensitive Data Disclosure
## CVE Details
- **CVE ID:** CVE-2026-85706
- **CVSS Score:** Not explicitly listed in text, but categorized as **HIGH** risk for government and large business entities.
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
## Affected Systems
- **Products:** GitLab Community Edition (CE) and Enterprise Edition (EE).
- **Versions:**
- 18.7 to 19.1.7 (Fixed in 19.1.8)
- 19.2 to 19.2.5 (Fixed in 19.2.6)
- 19.3 to 19.3.1 (Fixed in 19.3.2)
- **Configurations:** Systems utilizing GitLab’s repository commits API.
## Vulnerability Description
A path traversal flaw exists in GitLab’s repository commits API. The vulnerability allows an attacker to bypass directory restrictions via a single crafted HTTP request. By manipulating the API request, an unauthorized user can read arbitrary files from the server's filesystem, including sensitive configuration files and credentials.
## Exploitation
- **Status:** **Exploited in the wild.** Reports indicate exploitation occurred within 24 hours of discovery.
- **Complexity:** Low (Can be executed via a single HTTP request).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** **High** (Exposure of SSH keys, database credentials, deploy tokens, and CI/CD variables).
- **Integrity:** **High** (Retrieved credentials may allow attackers to modify code or system configurations).
- **Availability:** **Medium/High** (Potential for full system takeover depending on the level of access gained).
## Remediation
### Patches
Update GitLab to the following stable versions:
- **19.1.8**
- **19.2.6**
- **19.3.2**
### Workarounds
- No specific software workaround is provided; immediate patching is highly recommended.
- Apply the **Principle of Least Privilege**: Ensure GitLab services run as non-privileged users to limit the scope of file access.
## Detection
- **Indicators of Compromise:** Monitor web server logs for unusual or malformed requests targeting the repository commits API endpoint, specifically those containing path traversal sequences (e.g., `../`).
- **Detection methods and tools:**
- Perform automated vulnerability scans of externally exposed assets (CIS Safeguard 7.6).
- Deploy Endpoint Detection and Response (EDR) or Host-Based Intrusion Prevention Systems (HIPS) to detect unauthorized file access (CIS Safeguard 13.7).
## References
- **Vendor Advisory:** hxxps[:]//about[.]gitlab[.]com/
- **NVD Detail:** hxxps[:]//nvd[.]nist[.]gov/vuln/detail/CVE-2026-85706
- **Security Research:** hxxps[:]//securityaffairs[.]com/198945/hacking/gitlab-cve-2026-85706-one-http-request-no-authentication-full-file-read-exploited-within-24-hours[.]html