GitLab Users Urged to Patch Critical Path Traversal Flaw Under Active Exploitation

GitLab users are being urged to patch a critical path traversal vulnerability that is currently being exploited in the wild. The flaw, tracked as CVE-2026-85706, has been assigned a maximum CVSS severity score of 10.0.

The vulnerability allows unauthenticated users to read arbitrary files from a GitLab server. This is possible due to improper path confinement and missing authentication enforcement within the repository commits API.

Active Exploitation Detected

Cybersecurity vendor Watchtower reported detecting “in-the-wild probes” for the bug on 11 September. While GitLab has not officially flagged the vulnerability as being exploited, the detection of active probing suggests that widespread exploitation may be imminent.

The US Cybersecurity and Infrastructure Security Agency (CISA) has also added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Civilian federal agencies are mandated to remediate the issue by 15 September, although CISA recommends that private sector organisations follow similar patching protocols.

Affected Versions and Remediation

The vulnerability affects GitLab CE and EE in the following versions:

• All versions of 18.7 prior to 19.1.8
• All versions of 19.2 prior to 19.2.6
• All versions of 19.3 prior to 19.3.2

Organisations running self-hosted GitLab instances that are accessible via the public internet should patch immediately or remove public access to mitigate the risk. Security teams can identify potential exploitation attempts by searching log files for HTTP POST requests to the /api/v4/projects/{id}/repository/commits/ URI containing “file.path” parameters.

The emergence of this flaw comes amid warnings from security experts that AI tools are being used by threat actors to identify novel vulnerabilities and weaponise them more rapidly than in previous years.