Executive brief
GitLab's web platform for source code management contains a flaw in its commits API that allows anyone on the internet to read arbitrary files from affected servers without logging in. An attacker could exploit this to steal sensitive source code, configuration files, credentials, or other confidential data stored on the server, potentially compromising the entire organization's intellectual property and security posture.
Technical details
This path traversal vulnerability exists in GitLab's repository commits API due to improper path confinement validation and missing authentication checks. An unauthenticated attacker can craft requests to the commits API endpoint that traverse outside intended directory boundaries using path manipulation techniques (e.g., "../" sequences), allowing arbitrary file reads from the server's filesystem. The vulnerability requires network access to the GitLab instance but no authentication or user interaction. Successful exploitation enables attackers to read sensitive files including source code, configuration files, environment variables, and potentially credentials. The vulnerability has been actively exploited in the wild; patches or upgrades to patched versions are recommended.
Affected products
- GitLab GitLab Community Edition
- GitLab GitLab Enterprise Edition
Timeline
- 2026-09-11: disclosed: CVE-2026-85706 published
- exploited: Confirmed active exploitation in the wild