CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.

CVE-2026-85706 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-09-12

GitLab's web platform for source code management contains a flaw in its commits API that allows anyone on the internet to read arbitrary files from affected servers without logging in. An attacker could exploit this to steal sensitive source code, configuration files, credentials, or other confidential data stored on the server, potentially compromising the entire organization's intellectual property and security posture.

Technologies: GitLab Community Edition, GitLab Enterprise Edition. Vendors: GitLab.

Quick answers

Is CVE-2026-85706 exploited in the wild?
Yes. CVE-2026-85706 is known to be exploited in the wild, first recorded on 11 September 2026. Treat it as urgent.
How severe is CVE-2026-85706?
Critical severity, with a CVSS score of 10, published 12 September 2026.
Which products and versions are affected?
GitLab GitLab Community Edition; GitLab GitLab Enterprise Edition.
Is there a fix for CVE-2026-85706?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85706 attacked?
It is attacked over the network.
Am I affected by CVE-2026-85706?
Check whether you run GitLab Community Edition, GitLab Enterprise Edition, GitLab Community Edition or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This path traversal vulnerability exists in GitLab's repository commits API due to improper path confinement validation and missing authentication checks. An unauthenticated attacker can craft requests to the commits API endpoint that traverse outside intended directory boundaries using path manipulation techniques (e.g., "../" sequences), allowing arbitrary file reads from the server's filesystem. The vulnerability requires network access to the GitLab instance but no authentication or user interaction. Successful exploitation enables attackers to read sensitive files including source code, configuration files, environment variables, and potentially credentials. The vulnerability has been actively exploited in the wild; patches or upgrades to patched versions are recommended.

Affected products

  • GitLab GitLab Community Edition
  • GitLab GitLab Enterprise Edition

Timeline

  • 2026-09-11: disclosed: CVE-2026-85706 published
  • exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.