by Kastro
Paper/Archive/CVE-2026-85706

CVE-2026-85706

GitLab GitLab — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

KEV · due 14 SepEPSS 97%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Affected

ProductAffectedFixed inSource
GitLab18.7 – < 18.11.1218.11.12CNA
GitLab19.0 – < 19.0.919.0.9CNA
GitLab19.1 – < 19.1.819.1.8CNA
GitLab19.2 – < 19.2.619.2.6CNA
GitLab19.3 – < 19.3.219.3.2CNA

Scores by source

GitLab (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/work_items/627748exploithackerone.com/reports/3909881refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706kevcisa.gov/known-exploited-vulnerabilities-catalog