CVE-2026-85706 is a critical, unauthenticated path traversal vulnerability in the repository commits API of GitLab, one of the world's most widely-used DevOps and source-code management platforms, used extensively by software development organizations, government agencies, and enterprises globally to host and manage source code. Improper path confinement combined with missing authentication enforcement in the "/api/v4/projects/{id}/repository/commits/" endpoint allows a remote, unauthenticated attacker to submit a single crafted HTTP request with a manipulated "file.path" parameter and read arbitrary files from the GitLab server - including SSH keys, database credentials, deploy tokens, CI/CD variables, and other sensitive configuration data.

The following version(s) are affected:

GitLab CE/EE 18.7 through 19.1.7 – (Affected)
GitLab CE/EE 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 – (Affected)
GitLab CE/EE 19.1.8, 19.2.6, and 19.3.2 and later – (Not affected, patched); GitLab.com and GitLab Dedicated – (Already patched, no customer action required)

Typical attack flow:

1. Send a single crafted, unauthenticated HTTP request — A remote, unauthenticated attacker sends an HTTP request to the GitLab repository commits API endpoint, "/api/v4/projects/{id}/repository/commits/", with a manipulated "file.path" parameter designed to escape the intended directory.
2. Read arbitrary files from the GitLab server — Due to improper path confinement and missing authentication enforcement on this endpoint, the request succeeds without any credentials, returning the contents of arbitrary files on the server - potentially including SSH keys, database credentials, deploy tokens, and CI/CD variables.

Attack vectors:

• A network-based, unauthenticated attack against any self-managed GitLab CE/EE instance reachable from an untrusted network, most critically the public internet.
• No user interaction or privileges are required (CVSS AV:N/PR:N/UI:N).

Successful exploitation may allow attackers to:

• Read arbitrary files from the GitLab server without any authentication, using a single HTTP request.
• Obtain SSH keys, database credentials, deploy tokens, CI/CD variables, and other sensitive configuration data, and use them to pivot further into the organization's source code, infrastructure, and deployment pipelines.

CERTVU recommends the following:

1. Apply the Vendor Patch Immediately

   Upgrade self-managed GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (matching your current release line) as an emergency change, not scheduled maintenance, given confirmed active exploitation.

2. Restrict Network Access

   Restrict network access to the GitLab instance where patching must be delayed.

3. Audit for Prior Compromise

   Audit for signs of prior compromise before and after patching.

4. Rotate Credentials and Secrets

   Rotate credentials and secrets stored on or reachable from the GitLab instance.

Report any suspected compromise of a GitLab instance to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.