Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

GitLab allows anyone to read any file on server

CVE-2026-85706 · published 1 month ago · actively exploited
Summary

Both the free and paid versions of GitLab have a flaw in the commits feature that lets someone without an account view any file stored on the GitLab server. This could expose sensitive data such as configuration files or credentials. Apply the latest GitLab update or patch to close the gap and restrict file access.

What to do
  • Update gitlab to version 19.3.2.
Affected software
Ecosystem VendorProductAffected versions
– gitlab community edition and enterprise edition All versions
– gitlab gitlab < 19.1.8
< 18.11.12
>= 18.7.0, < 19.1.8
>= 19.2.0, < 19.2.6
>= 19.3.0, < 19.3.2
>= 18.7.0, < 18.11.12
>= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.8
Bitnami – gitlab >= 19.3.0, < 19.3.2
Fix: upgrade to 19.3.2
Original advisory text
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 3 days
and check for signs of compromise
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
93% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published12 Sep 2026
Updated9 Oct 2026
First seen11 Sep 2026
Sources
CVE-2026-85706 · CISA KEV
CVE-2026-85706 · NVD
CVE-2026-85706 · MITRE
BIT-gitlab-2026-85706 · OSV
Track software like this
Free during beta