The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab path traversal vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog after evidence that the flaw is being actively exploited.
The vulnerability affects both GitLab Community Edition (CE) and Enterprise Edition (EE). CVE-2026-85706 allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server.
The issue stems from improper path confinement and missing authentication enforcement in the repository commits API, allowing attacker-controlled path values to escape the intended repository directory.
CISA Warns of Critical GitLab Path Traversal Flaw
The flaw is categorized as CWE-35, a path traversal weakness that occurs when an application fails to properly restrict file-path operations to an expected directory.
In practical terms, an attacker could potentially use crafted traversal sequences to access sensitive files outside the GitLab repository path, depending on the permissions of the affected GitLab service process.
Potentially exposed files could include application configuration files, secrets, API credentials, deployment tokens, private keys, environment variables, and other server-side data.
Access to such material could enable follow-on attacks, including GitLab account compromise, cloud-environment access, source-code theft, or lateral movement into connected CI/CD infrastructure.
CISA added the vulnerability on September 11, 2026, and set a remediation due date of September 14, 2026. The agency said the issue requires forensic triage under Binding Operational Directive (BOD) 26-04, which prioritizes remediation based on exploitation risk and asset exposure.
Federal civilian executive branch agencies must apply vendor-provided mitigations by the deadline or discontinue use of affected products when no mitigation is available.
Organizations should also evaluate whether exposed GitLab instances are internet-facing and apply the relevant BOD 26-04 guidance for cloud-hosted services.
Although CISA has not identified confirmed ransomware-campaign use, the vulnerability’s unauthenticated nature and arbitrary file-read impact make it highly attractive to initial-access brokers and opportunistic threat actors.
Security teams should immediately identify all GitLab CE and EE instances, confirm deployed versions, and apply GitLab’s vendor-recommended fix or mitigation.
Administrators should also restrict public access to GitLab where operationally feasible, review reverse-proxy and application logs for suspicious repository commits API requests, and search for traversal-style payloads such as encoded directory-separator sequences.
Because CISA requires forensic triage, defenders should examine authentication events, API access logs, GitLab audit logs, and host-level telemetry for evidence of unauthorized file access.
Teams should rotate credentials and secrets stored on potentially affected servers, particularly GitLab runner tokens, personal access tokens, SSH keys, CI/CD variables, cloud credentials, and database passwords.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 has added a critical GitLab path traversal vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog after evidence that the flaw is being actively exploited.){kind=link}