Full Report
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under
Analysis Summary
# Vulnerability: GitLab Unauthenticated Path Traversal and File Read
## CVE Details
- **CVE ID:** CVE-2026-85706
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Improper Path Confinement / Missing Authentication Enforcement
## Affected Systems
- **Products:** GitLab Community Edition (CE) and Enterprise Edition (EE)
- **Versions:**
- 18.7 to 19.1.7
- 19.2 to 19.2.5
- 19.3 to 19.3.1
- **Configurations:** Self-managed instances with at least one **public project** existing on the server.
## Vulnerability Description
A maximum-severity path traversal flaw exists in the GitLab repository commits API. The vulnerability is caused by improper path confinement and a failure to enforce authentication. An unauthenticated remote attacker can exploit this to read arbitrary files from the underlying GitLab server, including system logs and configuration files.
## Exploitation
- **Status:** Exploited in the wild (active probes detected since September 11, 2026, 06:00 UTC).
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** Total (Ability to read sensitive configuration files, credentials, secrets, and source code).
- **Integrity:** High (Access to CI/CD secrets and source code allows for potential downstream supply chain poisoning).
- **Availability:** Low (Primary impact is data theft/system compromise).
## Remediation
### Patches
Update to the following versions immediately:
- GitLab 19.3.2
- GitLab 19.2.6
- GitLab 19.1.8
### Workarounds
- Limit public access to the GitLab instance if it does not require internet exposure.
- Ensure no projects are set to "Public" if immediate patching is not possible (though patching is the only definitive fix).
## Detection
- **Indicators of Compromise:** Look for unauthorized access to log files or GitLab `config` files.
- **Detection Methods:** Review web server logs for **HTTP POST** requests directed at:
- `/api/v4/projects/{id}/repository/commits/`
- Specifically monitor for the presence of the `file.Path` parameter within these requests.
## References
- **Vendor Advisory:** hxxps://docs[.]gitlab[.]com/releases/patches/patch-release-gitlab-19-3-2-released/
- **Original Report:** hxxps://thehackernews[.]com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
***
*Note: This summary also notes a secondary critical vulnerability addressed in the same patch cycle: **CVE-2026-87719** (CVSS 9.9), an insecure deserialization flaw in GitLab EE Duo Chat.*