CVE-2026-85706
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-09-11. Federal due date: 2026-09-14.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Impact
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| GitLab | GitLab | from 19.1 before 19.1.8 from 19.3 before 19.3.2 from 19.0 before 19.0.9 from 18.7 before 18.11.12 from 19.2 before 19.2.6 |
| Gitlab | Gitlab | from 18.7.0 before 18.11.12 from 19.0.0 before 19.0.9 from 19.1.0 before 19.1.8 from 19.2.0 before 19.2.6 from 19.3.0 before 19.3.2 |