GitLab Urges Users to Patch Maximum-Severity Path Traversal Flaw
GitLab has urged users to immediately patch their self-managed installations against a maximum-severity path traversal vulnerability that could allow unauthenticated attackers to access arbitrary files on vulnerable servers under certain conditions. The flaw, tracked as CVE-2026-85706, was discovered by a security researcher using the handle s3ntago and reported through GitLab's HackerOne bug bounty programme.
The vulnerability stems from improper path confinement and missing authentication enforcement in GitLab's repository commits API. If successfully exploited, an attacker could potentially read files outside the intended directory, creating a serious risk for sensitive information stored on affected servers.
Critical Flaw Affects GitLab Repository API
CVE-2026-85706 affects GitLab's repository commits API and is particularly concerning because it does not require authentication under the conditions described by the company. Path traversal vulnerabilities occur when applications fail to properly restrict file paths, potentially allowing attackers to move beyond an intended directory and access files elsewhere on a system.
GitLab has classified the issue at maximum severity and has released patched versions for affected self-managed installations. The company said users should upgrade immediately rather than wait for a later maintenance cycle because of the potential impact of the vulnerability.
GitLab Releases Emergency Security Updates
GitLab fixed CVE-2026-85706 in GitLab Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1. The company is recommending that all self-managed GitLab installations move to one of the patched versions as soon as possible.
GitLab.com users do not need to take action because the hosted service has already been updated. Customers using GitLab Dedicated are also not required to make changes, according to the company.
Another Critical Vulnerability Patched
The path traversal flaw was disclosed alongside another critical vulnerability, CVE-2026-87719, which affects GitLab Enterprise Edition. The second issue involves insecure deserialization in the GraphQL subscription serializer and could allow authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.
GitLab patched both vulnerabilities in its latest security releases. While the two flaws use different attack methods, their simultaneous disclosure adds urgency for organisations running self-managed GitLab environments to review their versions and apply the latest updates.
GitLab Has Faced Similar Security Risks
The latest vulnerability is not the first maximum-severity path traversal issue discovered in GitLab. In 2023, the company patched another path traversal flaw that could expose sensitive information including proprietary source code, credentials, tokens and files on unpatched servers.
GitLab vulnerabilities have also previously appeared on the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. Since November 2021, CISA has flagged four GitLab vulnerabilities as having been exploited in attacks, highlighting the importance of promptly applying security updates to exposed installations.
Millions of Users Could Be Affected
GitLab says its DevSecOps platform has more than 30 million registered users and is used by more than half of Fortune 100 companies. The platform is widely used for source-code management, software development and DevOps workflows, making security flaws particularly important for organisations that store sensitive development assets on self-managed servers.
For organisations running their own GitLab infrastructure, the immediate priority is to identify affected installations and upgrade to a patched release. The latest disclosure once again highlights how vulnerabilities in development platforms can potentially expose valuable source code, credentials and other sensitive information if security updates are delayed.
