GitLab path traversal in repository commits API allows unauthenticated file read (CVE-2026-85706)

What happened

CVE-2026-85706 is a path traversal flaw in GitLab CE/EE. The repository commits API does not properly confine file paths and lacks authentication enforcement, so an unauthenticated attacker can request arbitrary files from the GitLab server. The CVSS 3.1 vector scores this as 10.0 critical: network-reachable, low attack complexity, no privileges and no user interaction required, with high impact to confidentiality and integrity and none to availability.

CISA's Known Exploited Vulnerabilities catalog lists this CVE as exploited, and CISA SSVC assesses exploitation as active. GitLab has remediated the issue in the fixed releases listed below.

Who is affected

Affected releases are GitLab CE/EE from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab deployments commonly serve source code, CI/CD pipelines and internal development tooling, so a file-read flaw can still expose secrets, source code and configuration. The record does not state whether GitLab.com was affected.

What to do now

1. Apply the fixed release for your version line: GitLab 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.
2. Confirm whether the GitLab instance is reachable from the internet and restrict access to the repository commits API or the server where possible until patching is complete. The CVSS vector shows network access without credentials or user interaction, so reducing exposure is a valid interim control.
3. Follow the CISA KEV required action: apply mitigations in line with vendor instructions and BOD 26-04 prioritisation, including CISA's forensics triage requirements. No separate vendor workaround is listed in this record.

How to detect it

There are no vendor indicators of compromise in this record. As a practical check, determine whether the GitLab instance is internet-exposed, and review logs for unauthenticated or unexpected access to the repository commits API from sources that do not ordinarily use it. Because CISA KEV records active exploitation, any exposed unpatched instance should be treated as a priority for forensic review if it was reachable before patching.

Beyond the patch

Because CISA KEV records active exploitation, detection and response are the first line after patching; Managed Detection & Response (MDR) can help identify post-exploitation activity on affected systems. Separately, because the commits API is reachable over the network without credentials, Virtual CISO Services (vCISO) can help you structure an exposure review so the next internet-facing GitLab issue is caught before it becomes an incident.