CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability
GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.
GitLab disclosed CVE-2026-85706, a CVSS 3.1 10.0 path traversal flaw in the repository commits API of self-managed GitLab CE/EE (18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2), exploitable without authentication to read arbitrary server files. Successful exploitation can expose credentials, tokens, SSH keys, and database credentials accessible to the GitLab process. Fixed versions 19.1.8, 19.2.6, and 19.3.2 were released September 10, 2026; GitLab.com and Dedicated were already patched and no workaround is provided. Horizon3 released a NodeZero Rapid Response test to validate exposure and advises credential rotation for internet-facing instances.
- CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) unauthenticated arbitrary file read
- Affects GitLab CE/EE 18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- Fixed in 19.1.8, 19.2.6, and 19.3.2, released September 10, 2026; no vendor workaround
- Horizon3 shipped a NodeZero Rapid Response test; credential rotation advised for exposed instances
- CVEs
- CVE-2026-85706
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
2 min read at horizon3.ai
CVE-2026-85706 is a critical GitLab CE/EE path traversal vulnerability that can allow unauthenticated attackers to read arbitrary server-side files. NodeZero® Rapid Response safely validates exposure.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.