GitLab patches max-severity path traversal flaw amid probes

GitLab has released urgent security updates to close two serious vulnerabilities, including a maximum severity path traversal flaw tracked as CVE-2026-85706. The company said the flaw can allow unauthenticated attackers to read arbitrary files from vulnerable self-managed servers, potentially exposing passwords, secrets and other sensitive data. The fix is available in GitLab Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1, and GitLab is asking all self-managed installations to upgrade immediately.

The path traversal vulnerability was discovered by a security researcher using the handle s3ntago and reported through GitLab's HackerOne bug bounty programme. According to GitLab, the weakness comes from improper path confinement and missing authentication enforcement in the repository commits API. In practice, a path traversal flaw lets an attacker manipulate a file path so that the application reads a file outside the directory it should normally access. Because the affected API does not require a logged-in user, an unauthenticated attacker can send a crafted request and, under certain conditions, read arbitrary data such as credentials and other secrets from the server.

One day after the patch was released, security company watchTowr reported that it had already seen attackers searching the internet for GitLab servers that remain vulnerable to CVE-2026-85706. watchTowr said its intelligence team is observing in-the-wild probes for the flaw and that attackers can read arbitrary files with a single HTTP request. The company warned that based on recent GitLab vulnerabilities, indiscriminate exploitation is likely not far away. Defenders should also look through log files for HTTP POST requests to URIs containing /api/v4/projects/{id}/repository/commits/ and file.path parameters, as that pattern may indicate an exploitation attempt.

GitLab also fixed a second critical vulnerability on the same day, tracked as CVE-2026-87719. That issue is an insecure deserialization weakness in the GraphQL subscription serializer and affects GitLab Enterprise Edition only. Insecure deserialization can happen when a program converts stored data back into objects it can use; if the process is not properly secured, an attacker can supply harmful data that gets executed. GitLab said an authenticated user with Duo Chat access could exploit CVE-2026-87719 to steal sensitive credentials and Advanced Search instance configurations. Both flaws were fixed in the same releases, and GitLab emphasised that GitLab.com is already running the patched version while GitLab Dedicated customers do not need to take action.

This is not the first time GitLab has dealt with a path traversal vulnerability. In May 2023, the company patched another maximum severity path traversal flaw, CVE-2023-2825, which could expose proprietary source code, user credentials, tokens and files on unpatched servers. A year later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI urged software makers to remove path traversal weaknesses from products before shipping, calling the class of bugs unforgivable since at least 2007. In January, GitLab also fixed a high severity two factor authentication bypass that allowed attackers who knew a user's account ID to circumvent two factor authentication. Since November 2021, CISA has flagged four GitLab vulnerabilities as exploited in attacks, including CVE-2021-22175 and CVE-2021-39935 in February of this year.

The GitLab DevSecOps platform has more than 30 million registered users and is used by over half of Fortune 100 companies, including Nvidia, Airbus, T-Mobile, Lockheed Martin, Goldman Sachs and UBS. For teams that run self-managed GitLab or other business critical web applications, staying current with security patches is essential. AEU-I, our security-first IT, infrastructure and consulting service, can help organisations plan vulnerability management and monitor for signs of malicious traffic. Because the latest fixes are already being actively probed, installing them without delay is the most important step.