Hackers Exploit Maximum Severity Flaw in GitLab
CISA added GitLab path traversal CVE-2026-85706 to KEV after in-the-wild probes; unauthenticated attackers can read arbitrary files.
CVE-2026-85706 is a maximum-severity path traversal flaw in GitLab CE/EE's repository commits API that allows an unauthenticated user to read arbitrary files from the server due to improper path confinement and missing authentication enforcement. It affects versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and was fixed on September 10. Watchtower reported detecting in-the-wild probes for the bug on September 11, and CISA added the CVE to its Known Exploited Vulnerabilities catalog with a September 15 federal patch deadline. Defenders are urged to hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters.
- Unauthenticated path traversal in GitLab CE/EE commits API enables arbitrary file read
- Affects 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; fixed September 10
- Watchtower detected in-the-wild probes on September 11
- CISA KEV addition sets September 15 patch deadline for federal agencies
- Hunt for POST requests to repository commits API containing file.path parameters
- CVEs
- CVE-2026-85706
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
2 min read at infosecurity-magazine.com
CISA warns that threat actors are exploiting a vulnerability with a CVSS score of 10. 0
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.