GitLab Patches Critical Path Traversal Flaw in Commits API

GitLab has released emergency security updates and strongly advised all self-managed server administrators to install them without delay. The cause is a maximum-severity vulnerability, CVE-2026-85706, involving path traversal.

What the problem is

The vulnerability lies in the repository commits API and stems from improper path restriction and a missing authentication check. According to GitLab, under certain conditions unauthenticated attackers can exploit it to read arbitrary files on vulnerable servers. The flaw was discovered by a security researcher going by the handle s3ntago, who reported it through GitLab's bug bounty program on the HackerOne platform.

At the same time, the company closed a second critical vulnerability — CVE-2026-87719. It involves insecure deserialization in the GraphQL subscription serializer, affects the Enterprise Edition, and allows authenticated users with access to Duo Chat to steal sensitive credentials and Advanced Search instance settings.

Which versions are fixed

Both issues have been resolved in Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1. GitLab.com is already running the patched version, and GitLab Dedicated customers need take no action. The company stresses that these releases contain important fixes and that all self-managed installations should be updated immediately.

Not the first time

This is not the first maximum-severity path traversal vulnerability for GitLab. In May 2023 a similar flaw, CVE-2023-2825, was patched after it exposed sensitive data on unpatched servers — source code, credentials, tokens and files. A year later, CISA and the FBI urged developers to eradicate such vulnerabilities before products ship, noting that these bugs have been called “unforgivable” since at least 2007.

In January GitLab also patched a high-severity vulnerability that allowed two-factor authentication to be bypassed if the target's account ID was known. Since November 2021, CISA has added four GitLab vulnerabilities to its list of actively exploited flaws, two of which (CVE-2021-22175 and CVE-2021-39935) were added in February of this year.

The GitLab platform has more than 30 million registered users and is used by more than half of the Fortune 100, including Nvidia, Airbus, T-Mobile, Lockheed Martin, Goldman Sachs and UBS. Given the scale of adoption, prompt updating is especially important.

Source: Bleeping Computer