CVE-2026-85706: GitLab Commits API Path Traversal

CVE-2026-85706 is a critical path-traversal flaw in the repository commits API of GitLab CE/EE that lets an unauthenticated attacker read arbitrary files from a self-managed GitLab server hosting at least one public project, and it was exploited in the wild within hours of the patch release, making it a priority for any self-managed GitLab instance.

CVE-2026-85706 is a path-traversal weakness (CWE-22) in the repository commits API of GitLab Community Edition and Enterprise Edition. NVD's description states that "under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API" (NVD).

NVD lists this CVE as fully analyzed (status "Analyzed") with a CVSS v3.1 base score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — network-reachable, low attack complexity, no privileges or user interaction required, a scope change, and high impact to confidentiality and integrity (no availability impact, since the flaw is a file read) (NVD).

CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-11, with a required-action due date of 2026-09-14; the catalog lists known ransomware campaign use as "Unknown" (CISA KEV).

GitLab's own patch-release advisory confirms CE/EE versions 18.7 through 19.3.1 (across the ranges listed above) are affected, fixed in 18.11.12, 19.0.9, 19.1.8, 19.2.6 and 19.3.2; self-managed instances were told to upgrade on an emergency basis, GitLab.com was already running a patched version, and GitLab Dedicated customers needed no action. GitLab also shipped three threat-detection rules to help operators identify exploitation attempts against the commits API (GitLab Patch Release 19.3.2/19.2.6/19.1.8).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.97355 (99.897th percentile) — among the highest EPSS scores possible, consistent with a critical, unauthenticated, internet-exploitable flaw in widely self-hosted software that was reportedly scanned and exploited within hours of disclosure (FIRST EPSS).

Because this flaw lets an unauthenticated attacker read arbitrary server-side files — including configuration, CI/CD and credential material — any self-managed GitLab instance on an affected version should be upgraded immediately, and operators should treat any secrets the GitLab process could read (CI/CD variables, runner and deploy tokens, registry credentials) as potentially exposed and rotate them.

• Unauthenticated attacker can read arbitrary files from a GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API (CWE-22). — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, NVD status Analyzed. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-11, due date 2026-09-14, ransomware use listed as Unknown. — CISA KEV
• Affects CE/EE 18.7-18.11.11, 19.0-19.0.8, 19.1-19.1.7, 19.2-19.2.5, 19.3-19.3.1; fixed in 18.11.12/19.0.9/19.1.8/19.2.6/19.3.2; GitLab.com already patched, Dedicated needs no action; three detection rules shipped. — GitLab Patch Release 19.3.2/19.2.6/19.1.8
• EPSS score is 0.97355 (99.897th percentile) as of 2026-10-26. — FIRST EPSS