CVE-2026-85706
published 2026-09-12CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6…
PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-14
Exploited in the wild
EPSS
91.95%
99.8th percentile
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 18.7 < 18.11.12 | 18.11.12 |
| gitlab | gitlab | >= 18.7.0 < 18.11.12 | 18.11.12 |
| gitlab | gitlab | >= 19.0 < 19.0.9 | 19.0.9 |
| gitlab | gitlab | >= 19.0.0 < 19.0.9 | 19.0.9 |
| gitlab | gitlab | >= 19.1 < 19.1.8 | 19.1.8 |
| gitlab | gitlab | >= 19.1.0 < 19.1.8 | 19.1.8 |
| gitlab | gitlab | >= 19.2 < 19.2.6 | 19.2.6 |
| gitlab | gitlab | >= 19.2.0 < 19.2.6 | 19.2.6 |
| gitlab | gitlab | >= 19.3 < 19.3.2 | 19.3.2 |
| gitlab | gitlab | >= 19.3.0 < 19.3.2 | 19.3.2 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GitLab up to 19.1.7/19.2.5/19.3.1 Repository Commits API missing authentication (WID-SEC-2026-3315)
vuldb·2026-09-17·CVSS 10.0
CVE-2026-85706 [CRITICAL] GitLab up to 19.1.7/19.2.5/19.3.1 Repository Commits API missing authentication (WID-SEC-2026-3315)
A vulnerability was found in GitLab up to 19.1.7/19.2.5/19.3.1. It has been rated as problematic. The impacted element is an unknown function of the component Repository Commits API. The manipulation leads to missing authentication.
This vulnerability is referenced as CVE-2026-85706. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
Upgrading the affected component is advised.
GHSA
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could
ghsa_unreviewed·2026-09-12
CVE-2026-85706 [CRITICAL] CWE-22 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
VulnCheck
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
vulncheck·2026
CVE-2026-85706 CWE-35 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Affected: GitLab Community Edition and Enterprise Edition
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for e
GitLab
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
vendor_gitlab·2026-09-12·CVSS 10.0
CVE-2026-85706 [CRITICAL] CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Affected products: GitLab
Affected versions: >=18.7, =19.2, =19.3, <19.3.2 (affected)
Solution: Upgrade to versions 19.1.8, 19.2.6, 19.3.2 or above.
Credit: Thanks [s3ntago](https://hackerone.com/s3ntago) for reporting this vulnerability through our HackerOne bug bounty program
CISA
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
cisa·2026-09-11
CVE-2026-85706 CWE-35 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Vulnerability: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Affected: GitLab Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are res
No detection rules found.
Metasploit
GitLab Unauthenticated Arbitrary File Read
metasploit·CVSS 10.0
CVE-2026-85706 [CRITICAL] GitLab Unauthenticated Arbitrary File Read
GitLab Unauthenticated Arbitrary File Read
This module exploits CVE-2026-85706, an unauthenticated arbitrary file read in the GitLab repository commits and files APIs. A path parsing discrepancy between GitLab Workhorse and Rails allows unsigned upload metadata to reach the Rails handler, where an attacker-controlled local path is read before authentication. The response disclosure is conditional. GitLab returns a fragment of file data in an error only when the file contains a percent sign that is not followed by two hexadecimal characters. URL-form delimiters can further bound the returned fragment. Files without a malformed percent sequence are read but are not returned to the attacker. GitLab CE and EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are aff
Nuclei
GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
nuclei·CVSS 10.0
CVE-2026-85706 [CRITICAL] GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the H
Hackernews
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
blogs_hackernews·2026-10-13·CVSS 8.2
CVE-2026-97229 [HIGH] GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.
"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said in a Monday advisory.
The flaw, tracked as CVE-2026-97229 , has been d
Rapid7
Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
blogs_rapid7·2026-09-25·CVSS 10.0
CVE-2026-85706 [CRITICAL] Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
This wrap-up comes from the beautiful country of Belgium, where the Metasploit team is team-building and team-eating while we cheer on our very own teammates giving talks - shout-out to @jburgess-r7 who gave a wonderful talk about some of his 0day research.
Team building is a wonderful corporate ritual in which security researchers — people whose job is to break stuff and find ways into places they shouldn't be — are released into hotels full of questionable tech, and then everyone acts surprised by what happens next. So far, the only leak has been the Manneken Pis.
Anyway, while we were busy learning that a country with three official languages still has zero words for "one waffle is enough," the internet continued to be on fire.
We’re gonna jump right into the deep end. GitLab. Unauth
Rapid7
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
blogs_rapid7·2026-09-14·CVSS 10.0
CVE-2026-85706 [CRITICAL] CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
## Overview
On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706 , a critical path traversal vulnerability ( CWE-22 ) in the repository commits API with a CVSSv3.1 score of 10.0 . According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions.
On September 11, 2026, CVE-2026-85706 was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. CISA set a remediation due date of September 14, 2026, for affected Federal Civilian Executive B
Checkpoint
14th September – Threat Intelligence Report
blogs_checkpoint·2026-09-14·CVSS 10.0
CVE-2026-72898 [CRITICAL] 14th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 14th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1. Exposed data included names and government identification numbers, while a criminal marketplace advertised a collection containing millions of identity documents, including driver’s licenses, associated with t
Hackernews
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
blogs_hackernews·2026-09-14
CVE-2026-85046 ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.
The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy.
Here’s what mattered this week.
## ⚡ Threat of the Week
OpenAI Agents Behind May 2026 Attack o
Hackernews
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
blogs_hackernews·2026-09-11·CVSS 9.1
CVE-2026-85706 [CRITICAL] GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.
The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under certain conditions.
The problem, per GitLab, stems from "improper path confinement and missing authentication enforcement in the repository commits API."
The issue
2026-09-12
Published
2026-09-11
Added to CISA KEV
Exploited in the wild