Skip to content

Back to the catalog

Rapid Reaction: GitLab Path Traversal Vulnerability (CVE-2026-85706)
watchtowr.comadvisory

Rapid Reaction: GitLab Path Traversal Vulnerability (CVE-2026-85706)

watchTowr's rapid-reaction analysis of CVE-2026-85706, a critical (CVSS 10.0) unauthenticated path traversal vulnerability in the GitLab CE/EE repository commits API, patched in versions 19.3.2, 19.2.6, and 19.1.8. The flaw allows an unauthenticated attacker to read arbitrary server-side files via the commits API due to improper path confinement and missing auth enforcement; watchTowr's honeypot network was already observing exploitation probes at time of publication. The post includes hunting guidance (searching logs for POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters) and patching priorities for self-managed instances.

TL;DR Critical CVSS-10.0 unauthenticated path traversal in GitLab's repository commits API (CVE-2026-85706), already being probed in the wild — patch self-managed instances immediately.
Open original ↗

CVEs named here

Technologies named here

Techniques named here

  • Path traversal via unauthenticated API request

Related in AppSec