CVE-2026-85706
Path traversal lets unauthenticated attackers read arbitrary files from GitLab servers
The flaw is improper path confinement and missing authentication enforcement in the repository commits API, allowing unauthenticated users to read arbitrary files from the GitLab server. It affects self-managed GitLab Community Edition and Enterprise Edition in version ranges 18.7 through 18.11.11, 19.0 through 19.0.8, 19.1 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1. It is on CISA's Known Exploited Vulnerabilities list, meaning attackers are actively using it, and fixed versions have been released.
GitLab Community Edition and Enterprise Edition · Updated 28 Oct · From 4 of our stories and the public records
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| GitLab 19.3 | 19.3.2 |
| GitLab 19.2 | 19.2.6 |
| GitLab 19.1 | 19.1.8 |
| GitLab 19.0 | 19.0.9 |
What to do
- Upgrade GitLab to 19.3.2, 19.2.6, 19.1.8, 19.0.9, or 18.11.12, depending on your current version.
- If you are a US federal agency, apply the fix by 2026-09-14 as CISA requires.
- Follow GitLab's security update guidance for self-managed installations.
What happened
- 11 SeptGitLab released fixes for CVE-2026-85706 in versions 19.3.2, 19.2.6, 19.1.8, 19.0.9, and 18.11.12.
- 11 SeptCISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog.
- 11 SeptSecurity firm watchTowr observed in-the-wild probes within hours of disclosure.
- 14 SeptCISA required US federal agencies to fix the vulnerability by this date.
- 3 OctGitLab users were warned that the vulnerability is under active exploitation.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-85706 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | critical 10.0 | 11 Sept | 97% |