GitLab Patches Critical Path Traversal Flaw Allowing Unauthenticated File Access

GitLab released critical security updates on September 10, 2026, to resolve a maximum-severity path traversal vulnerability. The flaw allows unauthenticated attackers to read arbitrary files from affected servers, posing a severe risk to self-managed installations.

Tracked as CVE-2026-85706, the vulnerability carries a CVSS score of 10.0, the highest possible risk rating. According to Cyber Security News, the flaw is located within the repository commits API and is the result of missing authentication enforcement combined with improper path confinement. The vulnerability was reported by security researcher s3ntago via GitLab's HackerOne bug bounty program.

Affected Versions and Patches

The vulnerability impacts both Community Edition (CE) and Enterprise Edition (EE) of the platform. Specifically, affected versions include GitLab 18.7 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1. To mitigate the risk, GitLab has released patched versions 19.3.2, 19.2.6, and 19.1.8, urging all self-managed users to update their systems immediately.

Broader Security Context

This patch was part of a larger security rollout addressing multiple high-risk issues. Alongside the path traversal flaw, GitLab fixed a critical insecure deserialization vulnerability (CVE-2026-87719) and a buffer overflow issue (CVE-2026-88765). The simultaneous discovery of these flaws underscores the persistent challenges of securing complex DevOps platforms, where API-based attacks and path traversal remain primary vectors for exploitation.

Industry Implications

Because CVE-2026-85706 allows for unauthenticated arbitrary file reads, the potential for damage is extensive. Attackers could potentially extract highly sensitive data, including SSH keys, database credentials, application settings, and internal secrets. Such a breach could lead to full server compromise or allow an attacker to move laterally through a corporate network, escalating a single API flaw into a wide-scale infrastructure breach.

Next Steps for Administrators

Administrators should prioritize the update to the patched versions listed in the official GitLab documentation. While the primary vulnerability has been addressed, the presence of multiple critical flaws in a single release suggests a need for rigorous auditing of API endpoints. Organizations are encouraged to verify their current versioning and ensure that all self-managed instances are aligned with the September 10 security baseline.