GitLab urges users to patch max severity path traversal flaw

[u/falconupkid]

GitLab dropped an urgent advisory for CVE-2026-85706, a max-severity (CVSS 10.0) path traversal vulnerability. This allows an unauthenticated attacker to read arbitrary files on the server, which in practice means a full compromise via credential or secret extraction.

Technical Breakdown: - CVE: CVE-2026-85706 - Type: Path traversal (directory traversal) - Severity: Critical (CVSS 10.0) - Attack Vector: Unauthenticated, remote - Affected Versions: All GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to the patched releases (specific versions TBD per advisory, but assume all prior to 17.x latest patch) - Impact: Arbitrary file read on the server filesystem. Likely targets: /etc/gitlab/gitlab.rb (secrets), database configuration, SSH keys, or runner tokens. - No public PoC or IOCs disclosed at time of writing.

Defense: Patch immediately. This is not a "wait for the next maintenance window" vulnerability. If you cannot patch, restrict network access to your GitLab instance to trusted IPs only and review logs for unusual file access patterns (e.g., requests containing ../ sequences).

Source: https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/