CVE-2026-85706: GitLab Path Traversal Vulnerability

CVE-2026-85706 Overview

CVE-2026-85706 is a path traversal vulnerability [CWE-22] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects the repository commits API and stems from improper path confinement combined with missing authentication enforcement. Unauthenticated attackers can read arbitrary files from the GitLab server over the network under certain conditions. CISA has added CVE-2026-85706 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The vulnerability affects all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from a GitLab server, including configuration files, secrets, tokens, and source code, without any user interaction.

Affected Products

GitLab CE/EE versions 18.7 through 19.1.7
GitLab CE/EE versions 19.2 through 19.2.5
GitLab CE/EE versions 19.3 through 19.3.1

Discovery Timeline

2026-09-12 - CVE-2026-85706 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-85706

Vulnerability Analysis

The vulnerability resides in the GitLab repository commits API endpoint. The API accepts user-supplied path parameters used to reference files associated with a commit. The endpoint fails to constrain those paths to the repository root and does not enforce authentication on the affected code path. An attacker can supply crafted path traversal sequences to escape the intended repository scope and read files elsewhere on the GitLab server filesystem. Because the request requires no credentials, the exposure extends to any GitLab instance reachable over the network, including internet-facing self-managed deployments. The EPSS data indicates a high probability of exploitation activity in the near term, and CISA KEV listing confirms exploitation in the wild.

Root Cause

Two defects combine to produce the flaw. First, input handling in the commits API does not normalize or validate file path parameters against the repository boundary, permitting traversal outside the intended directory. Second, an authentication check is missing on the affected route, so requests reach the vulnerable file resolution logic without a valid session or token. The combination reduces the exploit prerequisites to a single crafted HTTP request.

Attack Vector

Exploitation occurs remotely over HTTPS against the GitLab web tier. An attacker sends a crafted request to the repository commits API containing a manipulated path parameter that traverses outside the repository directory. The server resolves the path against the underlying filesystem and returns file contents in the API response. Targets of interest include /etc/gitlab/gitlab.rb, secrets.yml, database.yml, private keys under the GitLab install directory, and runner registration tokens. Refer to the GitLab Work Item #627748 and the HackerOne Report #3909881 for coordinated disclosure details.

Detection Methods for CVE-2026-85706

Indicators of Compromise

HTTP requests to repository commits API endpoints containing traversal sequences such as ../, encoded variants (%2e%2e%2f), or absolute paths in path or file parameters.
Unauthenticated API requests returning non-repository file contents, particularly YAML, Ruby configuration files, or private key material.
Anomalous spikes in 200 OK responses from the commits API originating from a small set of external IP addresses.
Access log entries showing commits API requests without associated session cookies or PRIVATE-TOKEN headers.

Detection Strategies

Parse GitLab production and API logs (production_json.log, api_json.log) for commits API paths containing traversal patterns or references to system files.
Alert on unauthenticated requests to /api/v4/projects/*/repository/commits/* endpoints that return large or binary payloads.
Correlate outbound egress from the GitLab server with inbound API activity to detect follow-on credential reuse after file disclosure.

Monitoring Recommendations

Enable verbose access logging on the GitLab reverse proxy or load balancer and forward events to a centralized SIEM.
Monitor for rotation-worthy secrets appearing in outbound traffic or in unexpected authentication attempts across integrated systems.
Review the CISA KEV entry for CVE-2026-85706 for updated federal remediation deadlines and detection guidance.

How to Mitigate CVE-2026-85706

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.1.8, 19.2.6, or 19.3.2 or later as appropriate for your release branch.
Restrict network access to the GitLab web interface using firewall rules or a VPN until patching is complete.
Rotate all secrets that may have been exposed, including secret_key_base, database credentials, OAuth application secrets, runner registration tokens, and SSH host keys.
Audit access logs since the earliest affected version was deployed for indicators listed above.

Patch Information

GitLab has released fixed versions 19.1.8, 19.2.6, and 19.3.2 that add authentication enforcement and path confinement on the affected commits API. Self-managed operators should apply the corresponding upgrade for their major.minor branch. GitLab.com is already patched. Consult the GitLab Work Item #627748 for release notes and upgrade paths.

Workarounds

If immediate patching is not feasible, block requests to the repository commits API at the reverse proxy layer for unauthenticated clients.
Add a WAF rule to drop requests to commits API paths containing .., %2e%2e, or absolute path prefixes such as /etc/ or /var/.
Restrict inbound access to the GitLab instance to trusted CIDR ranges until upgrades are validated.

bash

# Example NGINX configuration to block traversal patterns on the commits API
location ~ ^/api/v[0-9]+/projects/.+/repository/commits/ {
    if ($request_uri ~* "(\.\./|%2e%2e|/etc/|/var/)") {
        return 403;
    }
    proxy_pass http://gitlab_upstream;
}