GitLab urges users to patch max severity path traversal flaw

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2023-2825.

The security flaw, discovered by a security researcher using the 's3ntago' handle and reported via GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API.

According to GitLab, unauthenticated attackers can exploit CVE-2023-2825 to read arbitrary files from vulnerable servers "under certain conditions."

Yesterday, GitLab patched a second critical vulnerability tracked as CVE-2026-87719 that stems from an insecure deserialization weakness in the GraphQL subscription serializer.

CVE-2026-87719 affects GitLab EE and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.

GitLab urges users to patch max severity path traversal flaw

Other newsrooms on this story

Related reading

GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read

GitLab Vulnerability Exploited One Day After Disclosure

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

Critical GitLab Flaw Exploited Shortly After Disclosure

GitLab Patches Code Execution, Information Disclosure Vulnerabilities

Critical GitLab Zero-Click Flaw Poses Mitigation Challenges