CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
CISA added CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026. The flaw affects GitLab CE/EE versions 18.7-19.1.7, 19.2-19.2.5, and 19.3-19.3.1, allowing unauthenticated attackers to read arbitrary files from affected servers without user interaction. Fixes are available in GitLab 19.1.8, 19.2.6, and 19.3.2, and federal civilian agencies must remediate by September 14, 2026 under Binding Operational Directive 26-04. GitLab credited researcher s3ntago via HackerOne; arbitrary file disclosure could expose credentials, tokens, and CI/CD secrets useful for follow-on intrusions.
- CVE-2026-85706 is a CVSS 10.0 unauthenticated path traversal in GitLab's repository commits API
- CISA added the flaw to KEV on September 11, 2026 with a September 14 federal remediation deadline
- Affected GitLab CE/EE builds span 18.7-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2
- Exploitation requires no account or user interaction, enabling arbitrary file reads on internet-facing servers
- Leaked files may reveal source code, CI/CD configs, tokens, and secrets for follow-on attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed. Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts. | 10.0 | 12% | KEV PoC ×9 |
| massLikely >1,000,000 aggregate users across hundreds of thousands of self-managed CE/EE deployments, with tens of thousands of instances directly exposed to the… |
Full article441 words · extracted from cybersecuritynews.com · click to collapse
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw.
The issue affects GitLab Community Edition and Enterprise Edition deployments and carries a maximum CVSS severity score of 10.0.
CVE-2026-85706 is a path traversal vulnerability in GitLab’s repository commits API. GitLab said that, under certain conditions, an unauthenticated attacker could exploit improper path confinement and missing authentication enforcement to read arbitrary files from an affected GitLab server.
Path traversal flaws occur when an application fails to properly restrict file paths supplied through requests. In this case, exploitation could allow an external attacker to move outside the intended repository directory structure and request files elsewhere on the server.
The exposure is particularly serious because it requires no account, user interaction, or prior access, substantially lowering the barrier to internet-based exploitation.
The vulnerability affects GitLab CE/EE versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1. Organizations operating self-managed GitLab instances should identify exposed assets immediately and upgrade to GitLab 19.1.8, 19.2.6, 19.3.2, or a later supported release, depending on their deployment branch.
CISA added the flaw to the KEV catalog on September 11, 2026, and set a remediation deadline of September 14, 2026, for federal civilian executive branch agencies.
The agency has also marked the issue as requiring forensic triage under Binding Operational Directive 26-04, reflecting the possibility that vulnerable systems may already have been accessed before patching.
Although CISA currently lists ransomware use as unknown, GitLab servers are high-value targets because they can host proprietary source code, CI/CD configurations, access tokens, deployment scripts, and other sensitive development data.
Arbitrary file disclosure can also help attackers identify credentials, secrets, configuration details, and other information useful for follow-on intrusion activity.
Security teams should prioritize patching internet-facing GitLab systems, review GitLab and reverse-proxy logs for unusual repository commits API requests, and investigate unexpected file-access patterns. Teams should also rotate potentially exposed credentials, tokens, and secrets after assessing the scope of any compromise.
GitLab credited security researcher s3ntago for reporting the flaw through its HackerOne bug bounty program. The weakness is associated with CWE-35, a category covering improper limitation of pathname access that can enable attackers to access files outside an intended restricted directory.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/cisa-gitlab-path-traversal/