CISA Adds GitLab Path Traversal Flaw to Exploited Vulnerabilities Catalog

September 14, 2026 at 03:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

GitLab patched a maximum severity path traversal vulnerability, CVE-2026-85706, on September 10. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 11, with a federal remediation deadline of September 15. Security vendor watchTowr reported in-the-wild probes for the vulnerability.

Key Facts

CVE-2026-85706 is a path traversal vulnerability in GitLab CE/EE affecting versions 18.7 through 19.3.1, with a CVSS score of 10.0.
GitLab released patched versions 19.1.8, 19.2.6, and 19.3.2 on September 10, 2026.
CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a federal remediation deadline of September 15, 2026.
Security vendor watchTowr reported detecting in-the-wild probes for CVE-2026-85706 on September 11, 2026.
The vulnerability allows unauthenticated attackers to read arbitrary files from GitLab servers via the repository commits API.

Vulnerability Details

CVE-2026-85706 is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. The vulnerability affects all GitLab Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. It stems from missing authentication enforcement and improper path confinement in the repository commits API, allowing unauthenticated users to read arbitrary files from the GitLab server. The flaw has a CVSS severity score of 10.0, the highest possible rating.

Exploitation and Response

GitLab released patched versions 19.1.8, 19.2.6, and 19.3.2 on September 10, 2026. On September 11, 2026, CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, citing active exploitation. CISA mandated that federal civilian agencies remediate the vulnerability by September 15, 2026, following BOD 26-04 guidance. Security vendor watchTowr reported detecting in-the-wild probes for the vulnerability on September 11, 2026, and urged organizations with public-facing self-hosted GitLab instances to patch immediately or remove public access. watchTowr advised defenders to hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters.