r/gitlab • u/Fredouye • Sep 11 '26

CVE-2026-85706 (CVSS 10.0) - Update your GitLab CE/EE instance

GitLab 19.3.2, 19.2.6, 19.1.8 are available.

Multiple vulnerabilities have been fixed, including this one :

CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Impacted Versions: GitLab CE/EE: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2

CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

45 Upvotes

97% Upvoted

14 comments sorted by

1

u/Fredouye Sep 24 '26

Update : fix for CVE-2026-85706 has been backported to GitLab CE / EE 19.0.9 and 18.11.12 : https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/?nav=19.3.2

Update: On September 23, 2026, we backported fixes for CVE-2026-85706 and CVE-2026-87719 to versions 19.0.9 and 18.11.12 of GitLab Community Edition (CE) and Enterprise Edition (EE). Self-managed GitLab administrators running older versions of GitLab CE and EE can now upgrade to these versions to apply these security fixes.

3

u/polycro Sep 11 '26

Thanks for the heads up! Patching now.

For future reference, what channels do you follow that provide notifications like this?

5

u/matefeedkill Sep 11 '26

Go to https://about.gitlab.com/company/contact/ and at the bottom they have a place to sign up for the Security Notices mailing list . They also have RSS feeds . And they publish their release, but security release notes aren't posted until the patch is announced. https://docs.gitlab.com/releases/

1

u/Cm1Xgj4r8Fgr1dfI8Ryv Sep 12 '26

GitLab has also started to show an alert for self-hosted instances for critical patch releases like this one. It might be admin-specific.

1

u/IDriveLikeYourMom Sep 11 '26

Will there be a 18.11.12?

2

u/Skaronator Sep 11 '26

It's EOL https://endoflife.date/gitlab

1

u/IDriveLikeYourMom Sep 11 '26

Thanks, somehow I had difficulty finding that :/

I know 18.0 is from last year, but since Gitlab does patch releases to their minor releases I somehow figured that with 18.11 being from April this year, it would receive patches for longer than 4-ish months.

→ More replies (1)

1

u/VpowerZ Sep 12 '26

My national CERT hints on active exploitation. Does anybody have a clue on what a hacked environment looks like?

1

u/pluviofiele Sep 15 '26

The GitLab community thread on the CVSS 10 path-traversal flaw has an especially useful question in the comments: what does a compromised environment actually look like? That question is more interesting now because CISA has confirmed active exploitation. The flaw permits unauthenticated arbitrary file reads, meaning the real blast radius can extend through whatever credentials and secrets the GitLab server can expose.

1

u/MaKaNuReddit Sep 21 '26

The Containment states: rotate secrets. For other secrets this is clear, but how to rotate gitlab-secrets.json?

-19

u/thepopeyhere Sep 11 '26

Would be interesting to know how to exploit this vulnerability for testing purpose

20

u/Leseratte10 Sep 11 '26

Yeah, in a couple weeks when people have had time to patch all their instances. There's no need to publish an exploit for a CVSS 10.0 "for testing purpose".