Critical Path Traversal (CVE‑2026‑85706) in GitLab Repository Commits API Allows Unauthenticated File Read
What It Is – A maximum‑severity path‑traversal flaw (CVE‑2026‑85706) in GitLab’s Repository Commits API permits an unauthenticated attacker to read arbitrary files on the server, including credentials and other secrets.
Exploitability – Publicly disclosed; no confirmed wild‑use yet, but watchTowr observed active probing of Internet‑exposed GitLab instances. CVSS ≥ 9.0 (critical).
Affected Products – GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.3.2, 19.2.6, and 19.1.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control monitoring of authentication and file‑access safeguards; a missing check is a control gap that auditors will flag.
- Patch cadence becomes part of defensible evidence that an organization exercises due diligence in vulnerability management.
- Log‑analysis of the
/api/v4/projects/{id}/repository/commits/endpoint provides audit‑ready artifacts to prove that exploitation attempts were detected or prevented.
Recommended Actions
- Upgrade all self‑managed GitLab installations to 19.3.2 (or later) immediately.
- Verify that the Repository Commits API enforces authentication and proper path confinement.
- Incorporate the patch status into your control‑mapping repository and capture the upgrade as evidence.
- Enable logging for the commits API and hunt for POST requests containing
file.pathparameters.
Source: BleepingComputer – GitLab urges users to patch max severity path traversal flaw