GITHUB-ACTIONS · SEPTEMBER 2026 · CONFIRMED

GitLab Path Traversal Vulnerability CVE-2026-85706: Critical Update

Severity
HIGH
Affected component
gitlab (github-actions)
Patched version
19.1.8 || 19.2.6 || 19.3.2 || nieuwer
CVE-2026-85706

GitLab has addressed a critical vulnerability enabling unauthenticated path traversal in the repository commits API. This flaw allowed arbitrary file reading on the system.

What happened

GitLab patched a high-severity vulnerability, tracked as CVE-2026-85706, which allowed unauthenticated users to perform path traversal in the repository commits API. This exploit enabled reading of arbitrary files on the system. CISA has confirmed the vulnerability is being exploited in the wild with public exploit code available. Users of GitLab Community and Enterprise Editions are advised to upgrade immediately.

The vulnerability was first flagged on September 12, 2026, and confirmed two days later. Affected versions include those below 19.1.8, 19.2.6, and 19.3.2. The patched versions are 19.1.8, 19.2.6, and 19.3.2 or newer. It is recommended to upgrade to these versions and review API logs for any suspicious requests involving parameters like file.path. Rotate any exposed credentials if abuse is detected.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If gitlab is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using GitLab versions below 19.1.8, 19.2.6, or 19.3.2.

What should I do right now?

Upgrade to GitLab 19.1.8, 19.2.6, 19.3.2 or newer and review your API logs for suspicious activity.

Has this been exploited in the wild?

Yes, this vulnerability is being actively exploited according to CISA.

Sources

Join the 0Day waitlist →

← Back to all threats