CVE-2026-85706: GitLab repository commits API path traversal allows unauthenticated file reads

Exploited in the wild Critical 10.0 EPSS 97.4% GitLab CE/EE

Improper path confinement and missing authentication enforcement in the GitLab CE/EE repository commits API let an unauthenticated attacker read arbitrary files from the GitLab server, including configuration and secrets files such as gitlab.yml. GitLab fixed it in 19.3.2, 19.2.6 and 19.1.8 on September 10, 2026, and backported the fix to 19.0.9 and 18.11.12 on September 23, 2026; versions before 18.7 are not affected. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-11 as exploited in the wild.

CVE-2026-85706CVE identifier
10.0CVSS 3.1 base score (critical)
2026-09-11added to CISA's exploited list (US federal deadline 2026-09-14)
97.4%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2026-09-12published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run GitLab CE/EE and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
GitLab says this patch includes database migrations: single-node instances are down until the migrations finish, while multi-node instances can use the zero-downtime upgrade procedure. Run `sudo gitlab-rake gitlab:check` afterwards.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

GitLab CE/EE 18.7 before 18.11.12
GitLab CE/EE 19.0 before 19.0.9
GitLab CE/EE 19.1 before 19.1.8
GitLab CE/EE 19.2 before 19.2.6
GitLab CE/EE 19.3 before 19.3.2

Fixed in:

GitLab 19.3.2
GitLab 19.2.6
GitLab 19.1.8
GitLab 19.0.9
GitLab 18.11.12

Am I affected?

sudo gitlab-rake gitlab:env:info
dpkg -l gitlab-ee gitlab-ce 2>/dev/null | grep ^ii
rpm -q gitlab-ee gitlab-ce

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

sudo apt update && sudo apt install gitlab-ee=19.3.2-ee.0
# other series: 19.2.x -> 19.2.6, 19.1.x -> 19.1.8, 19.0.x -> 19.0.9, 18.11.x -> 18.11.12, or any later patch release of your series
# Community Edition: sudo apt update && sudo apt install gitlab-ce=19.3.2-ce.0

Ubuntu

sudo apt update && sudo apt install gitlab-ee=19.3.2-ee.0
# other series: 19.2.x -> 19.2.6, 19.1.x -> 19.1.8, 19.0.x -> 19.0.9, 18.11.x -> 18.11.12, or any later patch release of your series
# Community Edition: sudo apt update && sudo apt install gitlab-ce=19.3.2-ce.0

RHEL, AlmaLinux, Rocky, Oracle

# RHEL/AlmaLinux/Oracle Linux 9 (use .el8 on EL8)
sudo dnf install gitlab-ee-19.3.2-ee.0.el9
# other series: 19.2.x -> 19.2.6, 19.1.x -> 19.1.8, 19.0.x -> 19.0.9, 18.11.x -> 18.11.12, or any later patch release of your series
# Community Edition: sudo dnf install gitlab-ce-19.3.2-ce.0.el9

Fedora

not packaged

SUSE / openSUSE

# openSUSE Leap 15.5
sudo zypper install gitlab-ee=19.3.2-ee.sles15
# SLES 12
sudo zypper install gitlab-ee=19.3.2-ee.0.sles12
# other series: 19.2.x -> 19.2.6, 19.1.x -> 19.1.8, 19.0.x -> 19.0.9, 18.11.x -> 18.11.12, or any later patch release of your series; Community Edition: gitlab-ce=<version>-ce.sles15 (SLES 12: -ce.0.sles12)

Amazon Linux

# Amazon Linux 2023
sudo dnf install gitlab-ee-19.3.2-ee.0.amazon2023
# Amazon Linux 2
sudo yum install gitlab-ee-19.3.2-ee.0.amazon2
# other series: 19.2.x -> 19.2.6, 19.1.x -> 19.1.8, 19.0.x -> 19.0.9, 18.11.x -> 18.11.12, or any later patch release of your series; Community Edition: gitlab-ce-<version>-ce.0.<suffix>

Arch Linux

sudo pacman -Syu

Alpine

apk update && apk upgrade gitlab-runner (runner only)

FreeBSD

pkg update && pkg upgrade gitlab-ce

Docker images

# in docker-compose.yml set: image: gitlab/gitlab-ee:19.3.2-ee.0  (other series: 19.2.x -> 19.2.6, 19.1.x -> 19.1.8, 19.0.x -> 19.0.9, 18.11.x -> 18.11.12, or any later patch release of your series; CE: gitlab/gitlab-ce:<version>-ce.0)
docker compose pull
docker compose up -d

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Look for signs of exploitation

api_json.log: unauthenticated requests (meta.client_id 'ip/<addr>', no user_id) whose multipart file.path or metadata.path parameter points outside the Workhorse upload temp directories, mainly POST /api/v4/projects/:id/repository/commits (also the repository files API).
Public exploits hide the route and parameter with percent-encoding and a trailing slash (for example %63ommits for commits, file%2epath for file.path), so do not match only the literal route.
A burst of distinct file.path values from one IP indicates filesystem enumeration. Watch for reads of gitlab.yml (/var/opt/gitlab/gitlab-rails/etc/ on Linux package installs), /etc/gitlab/gitlab-secrets.json, database.yml and /proc/<pid>/environ; GitLab warns that stolen secrets allow session and token forgery and decryption of CI/CD variables.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706

Related vulnerabilities

CVE-2026-87719

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.