Full Report
One flaw allows an unauthenticated attacker to read files from the server. GitLab urged operators of self-managed installations to upgrade immediately. The post GitLab’s critical flaw is already drawing internet-wide probes appeared first on CyberScoop.
Analysis Summary
# Vulnerability: Critical Path Traversal and Information Disclosure in GitLab
## CVE Details
- **CVE ID:** CVE-2026-85706 (Path Traversal), CVE-2026-87719 (Information Disclosure)
- **CVSS Score:** 10.0 (Critical) for CVE-2026-85706; 9.9 (Critical) for CVE-2026-87719
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
## Affected Systems
- **Products:** GitLab Community Edition (CE) and GitLab Enterprise Edition (EE)
- **Versions:**
- **CVE-2026-85706:** All versions from 18.7 up to 19.1.8; 19.2.x and 19.3.x prior to emergency patches.
- **CVE-2026-87719:** GitLab EE versions 18.3 onward.
- **Configurations:**
- **CVE-2026-85706:** Self-managed installations (unauthenticated).
- **CVE-2026-87719:** Self-managed installations with Duo Chat and Advanced Search enabled (authenticated).
## Vulnerability Description
**CVE-2026-85706:** A critical path traversal flaw exists in the interface handling repository commits. The code fails to properly sanitize file paths and lacks authentication enforcement, allowing an unauthenticated attacker to read arbitrary files from the server.
**CVE-2026-87719:** An information disclosure flaw where a logged-in user with Duo Chat access can inject commands into standard requests. This prompts the server to return configuration settings and passwords associated with the Advanced Search feature.
## Exploitation
- **Status:** Exploited in the wild (Internet-wide probes and scans detected by security firms).
- **Complexity:** Low (CVE-2026-85706 can be triggered via a single HTTP request).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Total (Full access to server files and sensitive configuration passwords).
- **Integrity:** None (Based on current report).
- **Availability:** None (Based on current report).
## Remediation
### Patches
- GitLab has released emergency patches in version **19.3.2** and corresponding backports for supported versions.
- Operators should upgrade self-managed instances to the latest patched release immediately.
### Workarounds
- No specific workarounds were provided; immediate patching is the recommended course of action for all self-managed installations. GitLab-hosted (SaaS) and Dedicated offerings are already mitigated.
## Detection
- **Indicators of Compromise:** Look for suspicious `POST` requests in web server logs.
- **Detection methods:** Inspect logs for requests directed at:
`hxps://[gitlab-server]/api/v4/projects/{id}/repository/commits/`
containing a `file.path` parameter used to reference files outside of the intended repository scope.
## References
- **Vendor Advisory:** [hxps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/](hxps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/)
- **CVE Records:**
- [hxps://www.cve.org/CVERecord?id=CVE-2026-85706](hxps://www.cve.org/CVERecord?id=CVE-2026-85706)
- [hxps://www.cve.org/CVERecord?id=CVE-2026-87719](hxps://www.cve.org/CVERecord?id=CVE-2026-87719)