GitLab Path Traversal Vulnerability Actively Exploited Hours After Patch Release
A critical path traversal vulnerability in GitLab, CVE-2026-85706, is being actively exploited in the wild just one day after patches were made available, highlighting the rapid threat actor response to newly disclosed flaws.
Threat actors have begun actively exploiting a critical path traversal vulnerability in GitLab, mere hours after the vendor released patches for the flaw. The vulnerability, tracked as CVE-2026-85706, carries a maximum CVSS score of 10/10 and allows unauthenticated attackers to read arbitrary files from a vulnerable GitLab server with a single HTTP request.
Attack surface management firm WatchTowr first observed in-the-wild exploitation attempts on Friday, September 11, 2026, just one day after GitLab announced the availability of fixes. The company warned that mass exploitation of the vulnerability is likely to follow swiftly, urging defenders to implement immediate protective measures.
GitLab versions affected by this critical path traversal flaw include all Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 prior to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The rapid exploitation underscores a growing trend where vulnerabilities are weaponized by malicious actors almost immediately after public disclosure, leaving little time for organizations to apply patches.
To detect potential exploitation attempts, WatchTowr advises security teams to scrutinize log files for specific HTTP POST requests. The indicators include requests targeting the URI /api/v4/projects/{id}/repository/commits/ that contain file.path parameters. This specific pattern can help identify reconnaissance or active exploitation activities.
This critical vulnerability was patched alongside 17 other security defects in the latest GitLab releases. Among these were other significant flaws, including CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer. This separate critical bug (CVSS 9.9/10) could allow attackers to access advanced search instance configurations and sensitive credentials.
The recent GitLab patch batch also addresses six high-severity vulnerabilities. These defects could enable attackers to achieve remote code execution, gain unauthorized access to protected CI/CD variables, launch cross-site scripting (XSS) attacks, or cause denial-of-service conditions. The comprehensive nature of the fixes highlights the ongoing security challenges faced by complex software platforms.
Organizations running self-hosted GitLab instances are strongly urged to upgrade to the latest patched versions as soon as possible to mitigate the immediate threat posed by CVE-2026-85706 and the other vulnerabilities. The swift exploitation of this path traversal flaw serves as a stark reminder of the critical importance of timely vulnerability management and patching in today's threat landscape.