CVE-2026-85706

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.7 through 19.1.7 GitLab CE/EE versions 19.2.0 through 19.2.5 GitLab CE/EE versions 19.3.0 through 19.3.1

Description An unauthenticated path traversal issue exists in the repository commits API. Due to improper path confinement and missing authentication enforcement, a remote attacker can read arbitrary local files accessible to the GitLab application context. Exploitation requires the presence of at least one public project on the instance. The flaw can be triggered by sending a crafted POST request to the endpoint "/api/v4/projects/{id}/repository/commits/" by manipulating the file.path variable. This issue has been actively exploited in the wild, with reports of rapid probing and public proof-of-concept material available. Successful exploitation may lead to the theft of sensitive information, including configuration files, CI/CD tokens, and deployment credentials.

Recommendations Upgrade GitLab CE/EE versions 18.7 through 19.1.7 to version 19.1.8. Upgrade GitLab CE/EE versions 19.2.0 through 19.2.5 to version 19.2.6. Upgrade GitLab CE/EE versions 19.3.0 through 19.3.1 to version 19.3.2. As a temporary mitigation, remove direct internet reachability, restrict access to trusted sources, or make public projects private.