Tuesday 15 September 2026
Evening EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
Security

GitLab Urges Immediate Patching of Maximum-Severity Path Traversal Flaw

Second critical vulnerability fixed in latest update involves insecure deserialization in GraphQL subscription serializer

edit
By LineZotpaper
Published
Read Time2 min
GitLab on Thursday urged all self-managed users to upgrade their servers immediately to patch a maximum-severity path traversal vulnerability, tracked as CVE-2026-85706, that could allow unauthenticated attackers to read arbitrary files under certain conditions. The company also fixed a second critical flaw, CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer affecting GitLab Enterprise Edition that could expose sensitive credentials and Advanced Search configurations. The patches are included in versions 19.3.2, 19.2.6, and 19.1.

The path traversal vulnerability, discovered by a security researcher known as 's3ntago' and reported through GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API. GitLab described the bug as a maximum-severity issue. The second flaw, CVE-2026-87719, affects GitLab EE only and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.

'These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,' the company warned. GitLab.com is already running the patched version, and GitLab Dedicated customers are not affected.

GitLab has a history of similar high-severity vulnerabilities. In May 2023, it addressed another maximum-severity path traversal flaw (CVE-2023-2825) that exposed sensitive data including proprietary software code and credentials. In 2024, CISA and the FBI urged software developers to eliminate path traversal vulnerabilities before shipping, calling such flaws 'unforgivable.' More recently, in January, GitLab patched a high-severity two-factor authentication bypass. Since November 2021, CISA has flagged four GitLab vulnerabilities as exploited in attacks.

§

Analysis

Why This Matters

  • Self-managed GitLab instances are widely used by organisations to store source code and CI/CD pipelines; unauthenticated file read could leak intellectual property, credentials, and internal configurations.
  • The second vulnerability (CVE-2026-87719) specifically targets Enterprise Edition users with Duo Chat, potentially compromising advanced search infrastructure and authentication secrets.
  • GitLab's strong language ('immediately') and the involvement of CISA tracking suggest active exploitation risk is considered high.

Background

Path traversal vulnerabilities allow attackers to break out of restricted directories and read arbitrary files on a server. GitLab, a popular DevOps platform, runs the repository management backbone for many companies. Both CISA and the FBI have repeatedly warned developers about path traversal flaws, describing them as 'unforgivable' since 2007. GitLab has faced multiple maximum-severity vulnerabilities in recent years, including a similar path traversal in 2023 and a 2FA bypass earlier this year.

Key Perspectives

GitLab: Urges immediate upgrade for self-managed instances, emphasises that its cloud-hosted version is already patched. Recommends administrators update without delay. Security Researchers: The flaw was responsibly disclosed via HackerOne bounty program, highlighting the role of coordinated vulnerability disclosure. Critics/Skeptics: The recurrence of 'unforgivable' path traversal bugs in a major DevOps tool raises questions about secure coding reviews and static analysis in GitLab's development lifecycle.

What to Watch

  • Adoption rate of patches among self-managed GitLab instances; many organisations run behind on updates.
  • Whether CISA adds CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, indicating active attacks.
  • Any proof-of-concept exploits that widen the attack surface beyond the 'under certain conditions' caveat.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe