UpHeron
All vulnerabilities

Servers and applications

CVE-2026-85706

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 11 Sept 2026.

Severity
Critical 10.0
Published
12 Sept 2026
Last changed
24 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2
Sources
NVD

Affected software

SoftwareAffected versions
GitLabServers and applications · cpe:a:gitlab:gitlab
  • From 18.7.0 before 18.11.12
  • From 19.0.0 before 19.0.9
  • From 19.1.0 before 19.1.8
  • From 19.2.0 before 19.2.6
  • From 19.3.0 before 19.3.2

Known exploited

CISA name
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
14 Sept 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-85706
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-85706