Skip to content

Back to the catalog

CVE-2026-85706: GitLab CE/EE Repository Commits API Path Traversal
horizon3.aiadvisory

CVE-2026-85706: GitLab CE/EE Repository Commits API Path Traversal

CVE-2026-85706 is a CVSS 10.0 critical path traversal vulnerability in GitLab CE/EE's repository commits API, caused by improper path confinement combined with missing authentication enforcement. It allows unauthenticated, remote attackers to read arbitrary files from the GitLab server — potentially exposing credentials, secrets, tokens, SSH keys, and database credentials. Affects versions 18.7 through 19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2.

TL;DR Unauthenticated critical (CVSS 10.0) path traversal in GitLab's commits API lets attackers read arbitrary server files; patch to 19.1.8/19.2.6/19.3.2.
Open original ↗
Document

What it is

CVE-2026-85706 is a critical (CVSS 3.1 10.0) unauthenticated path traversal in the GitLab CE/EE repository commits API. Under certain conditions it lets a remote attacker read arbitrary files readable by the GitLab server process. GitLab published fixes on September 10, 2026; public reporting and a Horizon3 NodeZero Rapid Response test followed on September 11.

How it works

GitLab attributes the flaw to a combination of improper path confinement and missing authentication enforcement in the commits API. No authentication or user interaction is required, and it is remotely exploitable with low complexity. The full CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — note the scope change (S:C) and that impact is confidentiality/integrity only (A:N, no availability). The page gives no proof-of-concept or request details.

Preconditions / Affected

Self-managed GitLab CE and EE:

  • 18.7 through 19.1.7
  • 19.2.0 through 19.2.5
  • 19.3.0 through 19.3.1

GitLab.com is already patched, and GitLab Dedicated customers need take no action — this is a self-managed problem. Exposure of specific files depends on deployment and OS file permissions on the GitLab process.

What to do

Upgrade to a fixed release: 19.1.8, 19.2.6, or 19.3.2.

Beyond patching, the page states two actions the summary does not:

  • Rotate secrets. Because exploitation can read server-side files, any credentials, tokens, SSH keys, or database credentials accessible to the GitLab process on a vulnerable internet-facing instance should be evaluated for rotation — patching alone does not undo prior exposure.
  • If you cannot patch immediately, restrict network access to the instance as a temporary risk-reduction measure only.

Caveats

There is no vendor workaround that substitutes for patching; network restriction is explicitly a stopgap, not a fix. GitLab qualifies exploitation as possible "under certain conditions," and Horizon3 does not enumerate those conditions or publish exploit specifics on this page.

CVEs named here

Technologies named here

Techniques named here

Related in AppSec