CVE-2026-85706 is a critical path traversal vulnerability in GitLab that permits unauthenticated attackers to read arbitrary files on the GitLab server via a crafted HTTP request. The affected versions include Community Edition and Enterprise Edition releases from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Exploitation attempts were detected in the wild just one day after the vulnerability disclosure and patch release. The patches also address 17 other vulnerabilities, including CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer that could expose sensitive credentials and configurations. Additional fixes cover high-severity flaws enabling remote code execution, access to protected CI/CD variables, XSS, and denial-of-service conditions.

Successful exploitation of CVE-2026-85706 allows unauthenticated attackers to read arbitrary files on the GitLab server, potentially exposing sensitive data. The related insecure deserialization vulnerability (CVE-2026-87719) could lead to unauthorized access to advanced search configurations and credentials. The combined vulnerabilities pose a critical risk to confidentiality and potentially to system integrity if other high-severity bugs are chained. Observed exploitation attempts shortly after disclosure indicate active threat activity targeting vulnerable GitLab instances.

GitLab has released official patches addressing CVE-2026-85706 and related vulnerabilities in versions 19.1.8, 19.2.6, and 19.3.2. Users of affected Community and Enterprise Editions should upgrade to these or later versions immediately. Defenders are advised to monitor HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' containing 'file.path' parameters to detect potential exploitation attempts. No additional mitigations are indicated beyond applying the official patches.