GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution
GitLab patched a CVSS 10.0 path traversal (CVE-2026-85706) plus deserialization and buffer-overflow flaws, urging self-managed users to update immediately.
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing CVE-2026-85706 (CVSS 10.0), an unauthenticated path traversal in the repository commits API enabling arbitrary file reads on both Community and Enterprise Editions. CVE-2026-87719 (CVSS 9.9) is insecure deserialization in the EE GraphQL subscription serializer that can expose Advanced Search configurations and credentials, while CVE-2026-88765 (CVSS 8.5) allows authenticated RCE via crafted project exports. The update includes database migrations, so single-node deployments will experience downtime; GitLab.com is already patched.
- CVE-2026-85706: CVSS 10.0 unauthenticated arbitrary file read in commits API
- CVE-2026-87719: GraphQL deserialization exposes Advanced Search configs and credentials
- CVE-2026-88765: buffer overflow allows authenticated RCE via malicious project import
- Versions 19.3.2, 19.2.6, 19.1.8 fix issues; GitLab.com already patched
- CVE-2026-85706 reported via HackerOne by researcher s3ntago
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
| CVE-2026-87719 | Authenticated GraphQL Subscription Flaw Leaks Search Credentials in GitLab EE | 9.9 | — | ||
| CVE-2026-88765 | Authenticated RCE via Malicious Project Import in GitLab EE Advanced Search | 8.5 | — |
From the original article
2 min read at cybersecuritynews.com
GitLab has released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities, including two critical flaws that could enable arbitrary file reads and credential theft. A separate high-severity issue in GitLab Enterprise Edition could allow authenticated attackers to achieve remote code execution by importing a malicious project export. The company released GitLab […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.