GitLab Path Traversal Allows Unauthenticated File Read
GitLab CE/EE contains a path traversal flaw due to improper path confinement and missing access controls, allowing an unauthenticated attacker to read arbitrary files from the server.
- Vendor
- GitLab
- Product
- GitLab CE/EE
- CVSS
- 10.0
- EPSS (exploit probability)
- 97.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-85706 being exploited?
Yes. CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in CIRCL's KEV catalog.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 97.4% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-85706 timeline
- Added to CISA KEV-1d (before NVD)
- First 0dayNews coveragesame day as NVD
- Published to NVD
- Added to CIRCL KEV+34d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-85706 is a path traversal vulnerability in GitLab Community Edition and Enterprise Edition. The flaw stems from improper path confinement and missing access controls, allowing an unauthenticated remote attacker to read arbitrary files from the GitLab server filesystem.
GitLab disclosed and patched this vulnerability on September 11, 2026, in patch release 19.3.2. In-the-wild exploitation probes began within hours of disclosure. CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on September 11, 2026.
Affected versions: GitLab CE/EE prior to 19.3.2. Check the GitLab patch release notes for the full version matrix.
Fix: Upgrade to GitLab 19.3.2 or later.
Other GitLab CE/EE CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-97229 GitLab CI/CD regex integer overflow enables unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 69.3% | |
| CVE-2026-110264 Integer overflow in Onigmo regex engine allows unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 1.3% | — |
| CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control Vulnerability | [ CRITICAL ] | 10.0 | 94.5% | |
| CVE-2021-22205 GitLab CE/EE ExifTool Remote Code Executionransomware usewrite-up | [ CRITICAL ] | 9.9 | 99.7% |
