Full Report
CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers
Analysis Summary
# Vulnerability: GitLab Unauthenticated Path Traversal (Arbitrary File Read)
## CVE Details
- **CVE ID:** CVE-2026-85706
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) / CWE-285 (Improper Authorization)
## Affected Systems
- **Products:** GitLab Community Edition (CE) and GitLab Enterprise Edition (EE)
- **Versions:**
- 18.7 to 19.1.7 (Fixed in 19.1.8)
- 19.2.0 to 19.2.5 (Fixed in 19.2.6)
- 19.3.0 to 19.3.1 (Fixed in 19.3.2)
- **Configurations:** Self-managed installations (Internet-facing instances are at highest risk). GitLab.com and GitLab Dedicated are not affected or have already been patched.
## Vulnerability Description
The flaw is a critical path traversal vulnerability within the GitLab Repository Commits API. It stems from a combination of improper path confinement and a failure to enforce authentication on the affected API endpoint. This allows an unauthenticated attacker to bypass security boundaries and read arbitrary files from the underlying server hosting the GitLab instance.
## Exploitation
- **Status:** Exploited in the wild (Confirmed by CISA and watchTowr); PoC-like probes observed.
- **Complexity:** Low (Can be executed via a single HTTP request).
- **Attack Vector:** Network (Unauthenticated).
## Impact
- **Confidentiality:** Total (Attacker can read source code, configuration files, credentials, and system secrets).
- **Integrity:** None directly (though stolen credentials can lead to integrity loss).
- **Availability:** Low (Potential for system instability depending on files accessed).
## Remediation
### Patches
Upgrade to the following versions immediately:
- GitLab v19.3.2
- GitLab v19.2.6
- GitLab v19.1.8
### Workarounds
- Disconnect self-managed GitLab instances from the public internet or restrict access via VPN/IP allowlisting until patches are applied.
## Detection
- **Indicators of Compromise:** Unusual HTTP POST requests targeting the Repository Commits API.
- **Detection Methods:** Inspect web server or application logs for requests to:
`POST /api/v4/projects/{id}/repository/commits/`
Look specifically for the presence of `file.path` parameters containing traversal sequences (e.g., `../`).
## References
- **Vendor Advisory:** hxxps[://]docs[.]gitlab[.]com/releases/patches/patch-release-gitlab-19-3-2-released/
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **watchTowr Research:** hxxps[://]labs[.]watchTowr[.]com (Referenced observation)