CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
CISA added CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026. The flaw affects GitLab CE/EE versions 18.7-19.1.7, 19.2-19.2.5, and 19.3-19.3.1, allowing unauthenticated attackers to read arbitrary files from affected servers without user interaction. Fixes are available in GitLab 19.1.8, 19.2.6, and 19.3.2, and federal civilian agencies must remediate by September 14, 2026 under Binding Operational Directive 26-04. GitLab credited researcher s3ntago via HackerOne; arbitrary file disclosure could expose credentials, tokens, and CI/CD secrets useful for follow-on intrusions.