🚨GitLab Path-Traversal Vulnerability Exploited in Wild
GitLab users, your systems are at risk
TL;DR
A critical GitLab path-traversal vulnerability (CVE-2026-85706) is actively exploited, allowing unauthenticated attackers to read arbitrary files. Patch now to avoid data theft and system compromise.
A critical GitLab path-traversal vulnerability (CVE-2026-85706) is actively exploited in the wild, allowing unauthenticated attackers to read arbitrary files from affected GitLab servers. This vulnerability, with a CVSS score of 10.0, can be exploited to steal secrets and configuration details, potentially enabling further access to the system. If you're running GitLab CE/EE versions 18.7 through 19.1.7, 19.2 through 19.2.5, or 19.3 through 19.3.1, you're at risk. GitLab patched this on September 11, but attackers were probing within hours of disclosure. The vulnerability was added to the Known Exploited Vulnerabilities (KEV) Catalog by CISA.
Key Points
GitLab path-traversal vulnerability (CVE-2026-85706) allows unauthenticated attackers to read arbitrary files from affected GitLab servers.
CVSS score of 10.0, indicating critical severity, with exploitation requiring at least one public project on the GitLab instance.
GitLab patched the vulnerability on September 11, but attackers were probing within hours of disclosure.
Vulnerability added to the Known Exploited Vulnerabilities (KEV) Catalog by CISA, highlighting the urgency of patching.
GitLab backported the fix to versions 19.0.9 and 18.11.12, despite both versions being end-of-life, to ensure broader protection.
Why It Matters
If you're running GitLab CE/EE versions 18.7 through 19.3.1, your systems are at risk from CVE-2026-85706. This vulnerability allows unauthenticated attackers to read arbitrary files, potentially stealing secrets and configuration details. Patching to the latest version is crucial to avoid data theft and system compromise. Attackers are actively probing, so immediate action is required.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,564 builders reading daily.