CVE-2026-85706
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
CISA Known Exploited Vulnerability
Vendor / Product
GitLab — Community Edition and Enterprise Edition
Date Added
2026-09-11
Remediation Due
2026-09-14
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706
Weakness Classification (1)
Affected Software (10)
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 18.7.0 – 18.11.12 |
| gitlab | gitlab | 18.7.0 – 18.11.12 |
| gitlab | gitlab | 19.0.0 – 19.0.9 |
| gitlab | gitlab | 19.0.0 – 19.0.9 |
| gitlab | gitlab | 19.1.0 – 19.1.8 |
| gitlab | gitlab | 19.1.0 – 19.1.8 |
| gitlab | gitlab | 19.2.0 – 19.2.6 |
| gitlab | gitlab | 19.2.0 – 19.2.6 |
| gitlab | gitlab | 19.3.0 – 19.3.2 |
| gitlab | gitlab | 19.3.0 – 19.3.2 |
References & Advisories (3)
Third Party Advisory
US Government Resource
Permissions Required
Broken Link