CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability
GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.
GitLab disclosed CVE-2026-85706, a CVSS 3.1 10.0 path traversal flaw in the repository commits API of self-managed GitLab CE/EE (18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2), exploitable without authentication to read arbitrary server files. Successful exploitation can expose credentials, tokens, SSH keys, and database credentials accessible to the GitLab process. Fixed versions 19.1.8, 19.2.6, and 19.3.2 were released September 10, 2026; GitLab.com and Dedicated were already patched and no workaround is provided. Horizon3 released a NodeZero Rapid Response test to validate exposure and advises credential rotation for internet-facing instances.