CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab CE/EE, is actively exploited and was added to CISA's KEV catalog.
GitLab patched CVE-2026-85706, a critical path traversal (CWE-22) in the repository commits API scoring CVSSv3.1 10.0, allowing unauthenticated arbitrary file reads on affected self-managed servers under certain conditions. CISA added it to the KEV catalog on September 11, 2026, citing active exploitation, with a September 14 remediation deadline and BOD 26-04 forensic triage requirements. Fixed versions are 19.1.8, 19.2.6, and 19.3.2; the release also fixes 17 other vulnerabilities including CVE-2026-87719, a CVSS 9.9 insecure deserialization flaw in GitLab EE.
- CVSS 10.0 unauthenticated path traversal in GitLab repository commits API
- Added to CISA KEV September 11 with September 14 remediation deadline
- Upgrade self-managed CE/EE to 19.1.8, 19.2.6, or 19.3.2 immediately
- Patch also fixes CVE-2026-87719, a 9.9 deserialization flaw in GitLab EE
- Hunt for compromise indicators after patching due to confirmed exploitation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
| CVE-2026-87719 | Authenticated GraphQL Subscription Flaw Leaks Search Credentials in GitLab EE | 9.9 | — |
From the original article
2 min read at rapid7.com
Overview On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3. 1 score of 10.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.