GitLab Releases Critical Patches for Multiple Vulnerabilities, Including Path Traversal and Insecure Deserialization

GitLab has released critical patch versions 19.3.2, 19.2.6, and 19.1.8 for its Community Edition (CE) and Enterprise Edition (EE) software, urging all self-managed installations to upgrade immediately. The updates address a range of vulnerabilities, with two critical flaws standing out: a path traversal issue in the repository commits API and an insecure deserialization vulnerability in the GraphQL subscription serializer.

The critical path traversal vulnerability, identified as CVE-2026-85706, allows unauthenticated users to read arbitrary files from the GitLab server. This is due to improper path confinement and missing authentication enforcement in the API. The vulnerability affects all versions from 18.7 prior to the patched releases and carries a CVSS score of 10.0, indicating a critical severity.

Another critical vulnerability, CVE-2026-87719, impacts GitLab EE and relates to insecure deserialization in the GraphQL subscription serializer. Under specific conditions, an authenticated user with Duo Chat access could exploit this flaw to bypass serialization and obtain Advanced Search instance configurations and sensitive credentials. This vulnerability has a CVSS score of 9.9.

Beyond these critical issues, the patch releases also fix several high-severity vulnerabilities. These include a buffer overflow in the Unicode conversion wrapper (CVE-2026-88765) in GitLab EE, which could lead to remote code execution. Additionally, high-severity flaws related to scheduled pipeline execution policy tests allowing developers to access protected CI/CD variables (CVE-2026-79708), cross-site scripting (XSS) in the Markdown JSON table renderer, and incorrect authorization in CI/CD environment variable scope matching have been remediated.

Several other high-severity Denial of Service (DoS) vulnerabilities in the GraphQL complexity limiter, a race condition in Merge Request Pipelines, and improper authentication issues in SAML SSO sign-in restriction enforcement are also addressed. Medium-severity flaws, including insufficient protection of credentials, XSS in the Content Editor, and authorization bypasses in protected environment approval rules, have also been patched.

GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action. For self-managed instances, it is strongly recommended to upgrade to the latest patch release for the supported version to maintain good security hygiene. Details of the security fixes are made public on GitLab's issue tracker 90 days after the release in which they were patched.

The company emphasizes its commitment to maintaining high security standards for all aspects of GitLab exposed to customers or hosting customer data. Users are advised to consult GitLab's security releases page and documentation for detailed information on the vulnerabilities and the recommended upgrade paths.

This comprehensive patch release underscores the ongoing efforts by GitLab to address a wide array of security weaknesses, from critical unauthenticated exploits to more nuanced authorization and input validation flaws, ensuring the integrity and security of its widely used platform.

This new article provides further technical details on the vulnerabilities patched by GitLab, specifically highlighting CVE-2026-85706, a critical path traversal flaw in the repository commits API that allows unauthenticated arbitrary file reads. It also elaborates on CVE-2026-87719, an insecure deserialization bug in the GraphQL subscription serializer for GitLab EE, which enables credential theft and configuration exposure for authenticated users with Duo Chat access. The article further details CVE-2026-88765, a high-severity buffer overflow in GitLab EE's Unicode conversion wrapper that permits RCE via malicious project imports.

CISA has now added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch the critical path traversal flaw by September 14, 2026. The agency also requires forensic triage for affected systems, indicating a high likelihood of prior compromise. This CISA action underscores the severity and active exploitation of the vulnerability, which allows unauthenticated attackers to read arbitrary files from GitLab servers.

GitLab has released further critical patch versions 19.4.1, 19.3.3, and 19.2.7, addressing two critical severity flaws (CVE-2026-89078 and CVE-2026-93577) related to Double Free and Integer Overflow in its Regular Expression Parser/Compiler, which could permit arbitrary code execution. These new patches also fix several other vulnerabilities, including Cross-site Scripting and authorization issues across various GitLab features, building upon previous advisories for path traversal and other high-severity flaws.