CVE-2026-85706

Published Sep 12, 2026

Last updated 24 days ago

Exploit known CVSS critical 10.0

SSH

Network

Open source

Supply chain

Database

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-85706 is a path traversal vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw resides within the repository commits API and stems from a combination of improper path confinement and a lack of authentication enforcement. Under specific conditions, an unauthenticated attacker can exploit this vulnerability to read arbitrary files from the affected GitLab server. Successful exploitation of CVE-2026-85706 can lead to the exposure of various sensitive data accessible to the GitLab server process, including configuration details, credentials, secrets, tokens, SSH keys, and database credentials. The vulnerability requires no authentication or user interaction and can be exploited remotely. GitLab released patches for this issue on September 10, 2026, in versions 19.1.8, 19.2.6, and 19.3.2, addressing all affected versions from 18.7 onwards.

Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Source: cve@gitlab.com
NVD status: Analyzed
Products: gitlab

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 5.8
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Exploit added on: Sep 11, 2026
Exploit action due: Sep 14, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

cve@gitlab.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "16F1EDAF-FD17-4B50-B9D2-643DF2770CAA",
            "versionEndExcluding": "18.11.12",
            "versionStartIncluding": "18.7.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "BFC013D4-560D-444B-A63F-6128E0CB8EC1",
            "versionEndExcluding": "18.11.12",
            "versionStartIncluding": "18.7.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "785E6802-2B47-414C-A0D7-910EBF325B9B",
            "versionEndExcluding": "19.0.9",
            "versionStartIncluding": "19.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "94A5B71B-5FDA-4758-9095-77AA1225282F",
            "versionEndExcluding": "19.0.9",
            "versionStartIncluding": "19.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "202657EE-3BCA-4770-BD25-EA7BF5139394",
            "versionEndExcluding": "19.1.8",
            "versionStartIncluding": "19.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "A7AFE4A6-85DB-4CA2-AE8A-A5EC6521520C",
            "versionEndExcluding": "19.1.8",
            "versionStartIncluding": "19.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "4A6AAECA-E557-43EF-B109-B92D1281E48B",
            "versionEndExcluding": "19.2.6",
            "versionStartIncluding": "19.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "8598AF82-D212-4B5D-ABC3-C12C9B217BF3",
            "versionEndExcluding": "19.2.6",
            "versionStartIncluding": "19.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "198FF0EF-1A45-484F-9268-F7821E006BA8",
            "versionEndExcluding": "19.3.2",
            "versionStartIncluding": "19.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "03B1901F-AAF4-421E-B704-5345CB840DEF",
            "versionEndExcluding": "19.3.2",
            "versionStartIncluding": "19.3.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.