Critical GitLab Path Traversal Flaw Draws Active Attacker Scanning
GitLab urges self-managed users to immediately patch a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. The flaw, discovered by researcher "s3ntago" through GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API. Under certain conditions, unauthenticated attackers can exploit the vulnerability to read arbitrary data from vulnerable servers, including credentials, secrets, and other sensitive information.
Security firm watchTowr reports that attackers are already probing Internet-exposed GitLab servers unpatched against CVE-2026-85706, and warns that indiscriminate exploitation is likely not far away. The company advises defenders to hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts. GitLab also patched a second critical vulnerability, CVE-2026-87719, an insecure deserialization weakness in the GraphQL subscription serializer that affects GitLab EE and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.
GitLab fixes both security issues in GitLab Community Edition and Enterprise Edition versions 19.3.2, 19.2.6, and 19.1, and strongly recommends that all self-managed installations upgrade immediately. GitLab.com already runs the patched version, and GitLab Dedicated customers do not need to take action. This is not the first time GitLab addresses a maximum severity path traversal flaw, having fixed a similar issue, CVE-2023-2825, in May 2023 that also exposed sensitive data.