Security experts have reported that a newly identified vulnerability in GitLab is being exploited by cybercriminals just one day after its public disclosure. The issue, known as CVE-2026-85706, is a critical path traversal flaw that poses significant risks, according to the attack surface management company, WatchTowr.
Details of the Vulnerability
The vulnerability, given a maximum severity score of 10 out of 10, permits unauthorized users to access and read files from the GitLab server. It affects all versions of the Community Edition (CE) and Enterprise Edition (EE) from 18.7 prior to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
WatchTowr has observed active attempts to exploit this vulnerability in the wild. These attempts were detected merely a day after GitLab released patches intended to mitigate this security flaw.
Exploitation and Defensive Measures
WatchTowr has noted that attackers are already probing for this path traversal vulnerability. The company advises defenders to scrutinize log files for HTTP POST requests directed at ‘/api/v4/projects/{id}/repository/commits/’ URIs that include ‘file.path’ parameters, which may indicate exploitation attempts.
To safeguard against this threat, it is imperative for those managing self-hosted GitLab instances to apply the latest patches immediately. These updates not only address the CVE-2026-85706 but also fix 17 other vulnerabilities, including another critical issue.
Additional Security Concerns
Among the other vulnerabilities addressed in the recent patch is CVE-2026-87719, a critical insecure deserialization flaw in the GraphQL subscription serializer. This flaw could potentially expose advanced search instance configurations and sensitive credentials to attackers.
Furthermore, the updates resolve six high-severity security issues that could lead to remote code execution, unauthorized access to CI/CD variables, cross-site scripting (XSS) attacks, and denial-of-service conditions.
Conclusion and Recommendations
The swift exploitation of GitLab’s vulnerability highlights the urgent need for timely patch implementations to protect against potential cyber threats. Organizations using affected GitLab versions should prioritize upgrading their systems immediately to prevent exploitation and secure their data.
