GitLab has urged users to patch a critical vulnerability, identified as CVE-2026-85706, following reports of active exploitation. The flaw, described as an "improper limitation of a pathname to a restricted directory" or "path traversal," affects all versions of GitLab CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
The vulnerability allows an unauthenticated user, under specific conditions, to read arbitrary files from the GitLab server. This is due to improper path confinement and a lack of authentication enforcement within the repository commits API. GitLab released patches for the issue on September 10.
While GitLab itself has not publicly confirmed in-the-wild exploitation, cybersecurity vendor watchtower reported detecting "in-the-wild probes" for the critical bug on September 11. The vendor cautioned that widespread, indiscriminate exploitation is likely imminent, based on patterns observed with previous GitLab vulnerabilities.
Organizations operating public-facing self-hosted GitLab instances are strongly advised to apply the patches immediately or restrict public access to their instances. Watchtower also recommended that administrators review log files for HTTP POST requests to "/api/v4/projects/{id}/repository/commits/" URIs that contain "file.path" parameters, as these could indicate exploitation attempts.
On the same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA highlighted that path traversal vulnerabilities are frequently targeted by malicious actors and pose significant risks, particularly to federal systems.
Civilian federal agencies are mandated to remediate KEV vulnerabilities, with a deadline of September 15 for this particular flaw. CISA also recommends that private sector organizations consider addressing KEV vulnerabilities as a best practice. The agency further advised following applicable BOD 26-04 guidance for cloud services or discontinuing use of the product if no mitigations are available.
