GitLab Vulnerability Exploited One Day After Disclosure
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 19.3.2 : patch affected systems as a priority.
Data as of 11 Sep 2026, 16:17 UTC
Rated Critical by SecurityWeek
- Patch
- Available – fixed in 19.3.2, 19.2.6, 19.1.8
What to do
AI-suggested
GitLab has released official patches addressing CVE-2026-85706 and related vulnerabilities in versions 19.1.8, 19.2.6, and 19.3.2. Users of affected Community and Enterprise Editions should upgrade to these or later versions immediately. Defenders are advised to monitor HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' containing 'file.path' parameters to detect potential exploitation attempts. No additional mitigations are indicated beyond applying the official patches.
Description
A critical path traversal vulnerability (CVE-2026-85706) in GitLab allows unauthenticated attackers to read arbitrary files from the server. The flaw affects multiple Community and Enterprise Edition versions prior to patched releases. Exploitation attempts were observed one day after the vulnerability was publicly disclosed and patched. Additional vulnerabilities, including a critical insecure deserialization bug (CVE-2026-87719), were also fixed in the same updates. Users of self-hosted GitLab instances are strongly advised to upgrade promptly to mitigate these risks.