CVE-2026-85706: GitLab CE/EE repository commits API path traversal allows unauthenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable arbitrary file read with CVSS 10.0 and confirmed exploitation via CISA KEV makes this an urgent patch-first issue.

What it is

GitLab CE/EE contains improper path confinement and missing authentication enforcement in the repository commits API, allowing an unauthenticated user to read arbitrary files from the GitLab server under certain conditions. The flaw affects versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and is rated CVSS 10.0. Because it is unauthenticated and network-reachable, any exposed GitLab instance is a candidate target.

Impact

An attacker can read arbitrary files from the GitLab server without authenticating, exposing repository data, configuration files, secrets and credentials stored on the host. The CVSS vector also scores high integrity impact, so tampering beyond read access cannot be ruled out from the record.

Attack surface

Reached over the network through the repository commits API; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. Any internet-exposed GitLab CE/EE instance in the affected version ranges is directly reachable.

Exploitation

CVE-2026-85706 was added to CISA KEV on 2026-09-11 with a remediation due date of 2026-09-14, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.11957 (95.9th percentile), and no ransomware campaign use is documented.

What to do

• Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later) as the primary fix.
• If immediate patching is not possible, restrict network access to the GitLab repository commits API and remove direct internet exposure per CISA BOD 26-04 guidance.
• Follow CISA's required action for KEV entries, including the 2026-09-14 due date and applicable forensics triage requirements.
• Rotate secrets, tokens and credentials stored on or reachable from affected GitLab servers, since arbitrary file read may have exposed them.
• Review GitLab server file permissions and segmentation to limit what an unauthenticated file-read primitive can reach.

Detection

• Hunt GitLab access logs for unauthenticated requests to the repository commits API with path traversal sequences or unusual file paths.
• Monitor for anomalous reads of files outside repository storage, such as configuration, secret or system files, by the GitLab service account.
• Check for outbound connections or data exfiltration from GitLab hosts following suspicious API requests.
• Audit GitLab instances for the affected version ranges and confirm upgrade status against 19.1.8, 19.2.6 and 19.3.2.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.