CVE-2026-85706
Description
CVE-2026-85706 is a critical CVSS 10.0 unauthenticated file read vulnerability in GitLab CE/EE versions 18.7 to 19.3.2, currently under active exploitation.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| gitlab | 18.7.0 | 18.11.12 | vulnerable |
| gitlab | 18.7.0 | 18.11.12 | vulnerable |
| gitlab | 19.0.0 | 19.0.9 | vulnerable |
| gitlab | 19.0.0 | 19.0.9 | vulnerable |
| gitlab | 19.1.0 | 19.1.8 | vulnerable |
| gitlab | 19.1.0 | 19.1.8 | vulnerable |
| gitlab | 19.2.0 | 19.2.6 | vulnerable |
| gitlab | 19.2.0 | 19.2.6 | vulnerable |
| gitlab | 19.3.0 | 19.3.2 | vulnerable |
| gitlab | 19.3.0 | 19.3.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
GitLab has released security updates to address this vulnerability. Administrators should immediately apply the security patches for GitLab Community Edition (CE) and Enterprise Edition (EE) provided in versions 19.1.8, 19.2.6, and 19.3.2.
Update affected systems
Verify your current GitLab version. If running versions 18.7 through 19.1.7, 19.2.0 through 19.2.5, or 19.3.0 through 19.3.1, upgrade to the respective fixed versions: 19.1.8, 19.2.6, or 19.3.2 or later.
Restrict access
Limit exposure by placing GitLab instances behind a VPN or restricting API access via firewall rules. Implement Web Application Firewall (WAF) rules to block common path traversal patterns (e.g., ../) targeting the repository commits API endpoint.
Monitor for exploitation
Conduct a forensic review of GitLab access logs for unauthorized access to the repository commits API. Look for unauthenticated requests and indicators of directory traversal, such as encoded slashes or attempts to access sensitive system files like /etc/passwd.
Detection Guidance
"Monitor GitLab's 'production_json.log' and web server logs for suspicious GET requests to the '/api/v4/projects/:id/repository/commits' endpoint. Look for path traversal sequences like '..%2F' or '../' in the URI. High-frequency unauthenticated API calls resulting in 200 OK responses from this endpoint are strong indicators of compromise. Additionally, deploy WAF signatures that detect CWE-22 patterns specifically targeting GitLab API structures."