Critical Path‑Traversal (CVE‑2026‑85706) in GitLab Repository Commits API Allows Unauthenticated File Read
What It Is – GitLab disclosed a CVE‑2026‑85706 flaw in its Repository Commits API that permits an unauthenticated attacker to traverse directories and read arbitrary files from the server’s filesystem.
Exploitability – The vulnerability is rated CVSS 10.0 (Critical). Public proof‑of‑concept probes appeared within hours of disclosure, indicating active exploitation attempts.
Affected Products – GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to the September 2026 security release.
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in access‑control enforcement at the application layer; continuous monitoring of file‑access logs is needed to prove that only authorized users can read repository data.
- Provides auditors with concrete evidence of a control failure; remediation and evidence collection satisfy a single VCF control objective that maps to many frameworks (e.g., NIST CSF 2.0 “Protect – Data Security”).
- Enterprise buyers increasingly demand a defensible audit trail showing that file‑system access controls are enforced and that any deviation is detected in real time.
Recommended Actions
- Apply GitLab’s September 2026 security patches to all instances immediately.
- Verify the patch level via the GitLab version endpoint or package manager.
- Enable and centralize file‑access logging; correlate logs with identity data to detect unauthorized reads.
- Map the “unauthorized file access” control to your framework of record and capture evidence in the Trust Center.
- Conduct a post‑patch validation scan for residual path‑traversal vectors.
Source: The Hacker News