Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild — Patch Immediately

What to do

The summary names both CVEs, their mechanisms, and the fix versions but carries none of the operational response. The page states it.

Upgrade to GitLab 19.3.2, 19.2.6, or 19.1.8. Multi-node deployments support zero-downtime upgrades, so there is no cluster-availability excuse to defer. If you cannot patch immediately, block public internet exposure of the GitLab instance or limit connectivity to trusted IP ranges — CVE-2026-85706 needs no authentication, so network reachability is the whole attack surface.

For detection, review HTTP POST logs against the commits API endpoint for requests carrying a file.path parameter:

/api/v4/projects/{id}/repository/commits/

Any such POST is a candidate exploitation attempt. If exploitation is suspected, assume file read succeeded and rotate every secret readable by the GitLab process: database credentials, SSH keys, deploy tokens, and CI/CD variables. The page frames these not as abstract "secrets" but as the concrete lateral-movement material an attacker harvests for full infrastructure takeover.

Affected

Both bugs have a lower version bound the summary omits, which matters for anyone triaging older installs:

• CVE-2026-85706 (CE and EE): 18.7 through 19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1.
• CVE-2026-87719 (EE only): 18.3 through 19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1.

Self-managed, internet-facing instances are the top risk. GitLab.com and GitLab Dedicated require no action — those environments are already protected, so this is exclusively a self-managed problem.

Timeline

WatchTowr Labs observed internet-wide scanning for CVE-2026-85706 beginning September 11, 06:00 UTC. CISA's KEV listing carries a federal remediation deadline of September 14 — both dates now in the past as of this writing, meaning active exploitation predates most defenders' awareness. The exploitation prerequisite is minimal: a single crafted POST, no auth, and at least one public project on the instance.