cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

Critical GitLab Path Traversal Vulnerability Actively Exploited; Emergency Patching Urged

· Original article ↗

Summary

CVE-2026-85706, a critical unauthenticated path traversal flaw in self-managed GitLab CE/EE, is being exploited in the wild. GitLab has released fixes, and organizations are urged to patch immediately and check for compromise.

Key points

  • CVE-2026-85706 is a CVSS 10.0 path traversal flaw in GitLab’s repository commits API that may allow unauthenticated arbitrary file reads.
  • CISA added the vulnerability to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
  • Affected self-managed CE/EE versions are fixed in 19.1.8, 19.2.6, and 19.3.2; organizations should upgrade immediately.
  • All self-managed deployment types are affected. GitLab.com is patched, and GitLab Dedicated customers do not need to act.
  • Rapid7 recommends checking for signs of compromise after patching; agencies covered by CISA BOD 26-04 should follow forensic triage requirements.
  • The patch release fixes 17 additional vulnerabilities, including a critical authenticated insecure deserialization flaw; only CVE-2026-85706 was known to be exploited at publication.

Article Details

Vulnerability Types
  • Path traversal (CWE-22)
  • Insecure deserialization (CWE-502)
Severity
CVE-2026-85706 is critical, CVSSv3.1 10.0. CVE-2026-87719 is critical, CVSSv3.1 9.9.
Affected Versions
  • GitLab CE/EE: all versions from 18.7 before 19.1.8; fixed in 19.1.8
  • GitLab CE/EE: all versions from 19.2 before 19.2.6; fixed in 19.2.6
  • GitLab CE/EE: all versions from 19.3 before 19.3.2; fixed in 19.3.2
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-85706patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 scoreCVE-2026-87719The patch release also addresses 17 other vulnerabilities. These include CVE-2026-87719, a critical insecure deserialization vulnerability (CWE-502) in GitLab EE with a CVSSv3.1 score of 9.9. GitLab states that, under

Vendors

GitLabOn September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in

Products

Exposure CommandExposure Command, InsightVM, and NexposeGitLab Community Edition (CE)On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) inGitLab DedicatedGitLab.com is already running a patched version, and GitLab Dedicated customers do not need to take action. Per GitLab, all self-managed deployment types are affected, including Omnibus, source code, and Helm chartGitLab Enterprise Edition (EE)GitLab.comGitLab.com is already running a patched version, and GitLab Dedicated customers do not need to take action. Per GitLab, all self-managed deployment types are affected, including Omnibus, source code, and Helm chartInsightVMExposure Command, InsightVM, and NexposeNexposeExposure Command, InsightVM, and Nexpose

Related Articles