GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

Ravie LakshmananSep 11, 2026Vulnerability / Web Security

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.

The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under certain conditions.

The problem, per GitLab, stems from "improper path confinement and missing authentication enforcement in the repository commits API."

The issue impacts the following versions of GitLab Community Edition (CE) and Enterprise Edition (EE) -

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

Other newsrooms on this story

Related reading

GitLab Vulnerability Exploited One Day After Disclosure

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

Critical GitLab Flaw Exploited Shortly After Disclosure

GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read

GitLab urges users to patch max severity path traversal flaw

GitLab Patches Code Execution, Information Disclosure Vulnerabilities