← News
/DISPATCH · 2026-09-12

CVE-2026-85706: GitLab Commit API Path Traversal CVSS 10.0 Under Internet-Wide Scanning

GitLab patched repository commit API path traversal CVE-2026-85706, CVSS 10.0. Unauthenticated attackers can read arbitrary files on the server with a single HTTP request. Added to CISA KEV.

GitLab released an emergency security patch on 10 September 2026 for path-traversal vulnerability CVE-2026-85706 in the repository commit API. CVSS 10.0. An unauthenticated remote attacker can read arbitrary files on the GitLab server with a single HTTP request. GitLab.com is patched; many self-managed instances remain exposed on the public internet. On 11 September, CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.

Incident Overview

GitLab issued a Critical Patch Release on 10 September. Fixed versions: 19.1.8, 19.2.6, and 19.3.2. The batch patched 17 vulnerabilities; three are relevant here: CVE-2026-85706 (repository commit API path traversal, CVSS 10.0, CE and EE); CVE-2026-87719 (insecure deserialization in GraphQL subscription serializer, CVSS 9.9, EE only); CVE-2026-88765 (buffer overflow in Advanced Search index Unicode conversion wrapper, CVSS 8.5, EE only). Affected versions: 18.7 through unpatched 19.1.7, 19.2.5, 19.3.1.

Technical Details

Vulnerability is in the API used to retrieve repository commit information. Root cause: improper path constraint combined with missing authentication enforcement (CWE-35). No credentials required. A request containing traversal sequences causes the server to access files outside the intended directory.

GitLab's CVSS 3.1 vector: `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`. Readable files depend on the GitLab service-account privileges. In practice typically include:

Vendor watchTowr observed internet-wide scanning of vulnerable servers within a day of the patch. 360 Vulnerability Research Institute successfully reproduced the issue, reading GitLab local config via a single unauthenticated request. Hunt POST requests to `/api/v4/projects/{id}/repository/commits/` for traversal sequences such as `..%2f` or `../` in the `file.path` parameter.

Impact Assessment

GitLab is used by more than 100,000 organizations for source hosting and CI/CD. A single instance often holds credentials for development, test, and production. The bug itself is arbitrary file read, but leaked files are commonly used for lateral expansion: CI/CD variables or cloud credentials yield access to build and deploy pipelines—classic supply-chain risk. CISA set a 14 September remediation deadline and required forensic review, indicating confirmed exploitation or high-confidence evidence.

Remediation

Only complete fix is upgrade. For Omnibus installs, confirm version with `dpkg -l gitlab-ce gitlab-ee` or `sudo gitlab-rake gitlab:env:info`, then upgrade to 19.1.8, 19.2.6, 19.3.2 or later:

`sudo apt-get install gitlab-ce=19.3.2-*   # adjust to the actual version line`

This patch includes a database migration; single-node instances will incur downtime during upgrade. If upgrade is not immediately possible, temporarily restrict instance network access to trusted IPs only—risk reduction, not a fix. After patching, rotate all credentials, tokens, and private keys readable by the GitLab service account. At the perimeter, WAF-block path-traversal requests against this API.

References