Improper Path Confinement in GitLab CE/EE Affecting User Access
CVE-2026-85706

10CRITICAL

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
12 September 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 28,300👾 Exploit Exists🟡 Public PoC🟣 EPSS 91%🦅 CISA Reported📰 News Worthy

What is CVE-2026-85706?

CVE-2026-85706 is a significant vulnerability found in GitLab Community Edition (CE) and Enterprise Edition (EE) that affects multiple versions released prior to specific patch updates. GitLab, a widely used platform for version control and collaborative software development, facilitates developers in managing their code repositories and automating workflows. The vulnerability arises from improper path confinement and inadequate authentication enforcement within the repository commits API. Under certain conditions, this flaw allows unauthenticated users to access and read arbitrary files from the GitLab server. The implications of this vulnerability are serious, as unauthorized access to sensitive code components or configuration files can lead to data leaks and compromise the security of an organization's software development lifecycle.

Potential Impact of CVE-2026-85706

  1. Unauthorized Data Exposure: The vulnerability could enable malicious actors to access sensitive information stored within GitLab repositories, including proprietary code, confidential documents, and user credentials, leading to potential data breaches.

  2. Increased Attack Surface: With the ability to read arbitrary files, attackers can gather intelligence on the target organization's infrastructure and practices, facilitating further attacks, including targeted phishing campaigns or social engineering attempts.

  3. Reputation Damage and Compliance Risks: Exploitation of this vulnerability could result in significant reputational harm to affected organizations, especially if sensitive data is leaked or misused. Furthermore, this could pose compliance issues with regulations requiring the protection of sensitive information, escalating potential legal liabilities.

CISA has reported CVE-2026-85706

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-85706 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

GitLab 18.7 < 18.11.12

GitLab 19.0 < 19.0.9

GitLab 19.1 < 19.1.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2026-85706
Created by guneykabel

CVE-2026-85706
Created by mhtsec

GitLabSniper
Created by ynsmroztas

News Articles

favicon imageBleepingComputer

GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.

3 days ago

favicon imageBleepingComputer

GitLab warns of max severity code execution vulnerability

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.

2 weeks ago

favicon imageInformation Queue

GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration

CVE-2026-85706 is a critical GitLab path-traversal vulnerability that has moved beyond theoretical risk into confirmed exploitation. It affects self-managed GitLab CE/EE and could allow an unauthentic

3 weeks ago

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627748
https://hackerone.com/reports/3909881
technical-descriptionexploitpermissions-required

EPSS Score

91% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 🟡

    Public PoC available

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • Vulnerability published

  • 🦅

    CISA Reported

  • 📰

    First article discovered by Securityweek

  • Vulnerability Reserved

Credit

Thanks [s3ntago](https://hackerone.com/s3ntago) for reporting this vulnerability through our HackerOne bug bounty program
.