CVE-2026-85706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-22
- Published
- 2026-09-12
- Last modified
- 2026-09-12
Affected products
- GitLab GitLab
- GitLab GitLab
- GitLab GitLab
Weakness type
Related vulnerabilities
- CVE-2026-90445 — An interface that accepts file uploads from authenticated users extracts the contents of uploaded...
- CVE-2026-49846 — libks has path traversal in kws HTTP parser via URI segment overflow
- CVE-2026-87910 — tarfile hardlink fallback ignores custom extraction filter rejection via None
- CVE-2026-87984 — An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an...
- CVE-2026-87983 — An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an...
- CVE-2026-87727 — a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an...
- CVE-2026-19991 — UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2026-77807 — AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter