GitLab Patches Critical CVSS 10 Path Traversal Flaw Exploited in the Wild

GitLab has issued urgent patches for a critical security vulnerability, CVE-2026-85706, which carries a maximum CVSS score of 10.0. This path traversal flaw, located within the repository commits API, allows unauthenticated attackers to read arbitrary files from the GitLab server under specific conditions. The vulnerability's severity was underscored by active exploitation attempts observed in the wild mere hours after its public disclosure, highlighting the immediate need for organizations to apply the vendor's fixes.

The root cause of the issue, as detailed by GitLab, lies in "improper path confinement and missing authentication enforcement in the repository commits API." This combination of weaknesses enables attackers to bypass intended access controls and traverse directory structures to access sensitive files. The affected versions of GitLab Community Edition (CE) and Enterprise Edition (EE) include all versions from 18.7 prior to 19.1.8, all versions from 19.2 prior to 19.2.6, and all versions from 19.3 prior to 19.3.2.

Threat intelligence firm watchTowr reported that active in-the-wild probes began as early as 06:00 UTC on September 11, 2026. The firm noted that the vulnerability allows external attackers to exfiltrate log files and GitLab-specific configuration files, potentially leading to the compromise of credentials, secrets, and other sensitive information. This marks the second critical GitLab vulnerability in recent weeks, following a previously exploited GraphQL code injection flaw (CVE-2026-19478).

Jake Knott, head of threat intelligence at watchTowr, emphasized the ease of exploitation, stating, "Exploitation requires just one requirement, at least one public project must exist." He further elaborated on the significant appeal of GitLab to attackers, noting that unauthorized access can grant them access to source code, CI/CD secrets, credentials, and the ability to inject malicious code into build pipelines. Such capabilities are highly sought after by threat actors for downstream compromise.

In addition to CVE-2026-85706, GitLab also patched a critical insecure deserialization bug in GitLab EE (CVE-2026-87719, CVSS score: 9.9). This flaw could lead to information disclosure, allowing an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials by bypassing serialization mechanisms. This vulnerability was addressed in the same patch releases: versions 19.3.2, 19.2.6, and 19.1.8.

GitLab strongly advises organizations running self-managed instances, particularly those exposed to the internet, to apply the latest patches immediately. As an interim measure, limiting public access to these instances is also recommended if direct internet exposure is not strictly necessary. The company stressed that the window for defense is narrowing, with the transition to indiscriminate mass exploitation likely imminent.

To detect potential exploitation attempts, defenders are advised to review log files for HTTP POST requests targeting the '/api/v4/projects/{id}/repository/commits/' URI that contain 'file.Path' parameters. Proactive monitoring and rapid patching are crucial to mitigate the risks associated with this high-severity vulnerability and prevent further compromise.