added to CISA Known Exploited catalog

Published September 10, 2026 CVE-2026-85706

GitLab had a critical flaw that let unauthenticated users read arbitrary files from the server. The flaw affected self-managed GitLab installations.

Severity
CriticalCVSS 3.1 · 10.0 · docs.gitlab.com
Fix
Fixed in 19.1.8
Weakness
CWE-35
Affects
Multiple Vendors+2 more
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Sep 11, 2026
Federal fix deadline
Sep 14, 2026

How it works

  • An unauthenticated user could reach GitLab's repository commits API.
  • Under certain conditions, a request could escape the allowed repository path.
  • GitLab could then read arbitrary files from its server because path restrictions and authentication checks failed.

What to do

Check your self-managed GitLab version and compare it with the affected ranges in the GitLab security release. GitLab.com is already patched, and GitLab Dedicated customers do not need to take action.

Upgrade self-managed GitLab CE or EE to 19.1.8, 19.2.6, or 19.3.2, matching your supported release branch.

Technical details

Affected software: Multiple Vendors, GitLab, Community Edition and Enterprise Edition

CVE-2026-85706 is a path traversal issue in the GitLab CE/EE repository commits API. GitLab rated it CVSS 10.0 because an unauthenticated user could read arbitrary server files, with confidentiality and integrity impact.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source