GitLab shipped an out-of-band emergency release on 10 September 2026, closing a flaw rated the maximum CVSS score of 10.0. CVE-2026-85706 lets unauthenticated attackers read arbitrary files from the server – an acute risk for self-hosted instances.
Path traversal in the commits API
GitLab attributes the bug to improper path confinement and missing authentication enforcement in the repository commits API. An attacker needs no credentials and no user interaction; a single network request of low complexity is enough to break out of the intended directory and read system files. That combination is why the flaw earns a perfect 10.0 score.
Affected versions and the fix
Vulnerable builds span Community and Enterprise Edition from 18.7 up to 19.1.8, the 19.2 branch before 19.2.6, and 19.3 before 19.3.2. GitLab bundled the fixes into versions 19.3.2, 19.2.6 and 19.1.8. GitLab.com is already patched, but anyone running a self-managed instance must update it themselves.
Attackers are already probing
Security firms report active internet-wide scanning since 11 September, and the US agency CISA added the bug to its Known Exploited Vulnerabilities catalog with a 14 September deadline for federal agencies. Administrators of self-hosted servers should apply the patch without delay.
Sources: GitLab Critical Patch Release 19.3.2, 19.2.6, 19.1.8 (GitLab Docs)
