The U.S. Cybersecurity and Infrastructure Security Agency has identified a critical vulnerability in GitLab, labeled as CVE-2026-85706, which is currently being exploited by attackers. This vulnerability affects both the Community Edition and Enterprise Edition of GitLab, and carries the highest possible CVSS severity score of 10.0, indicating its critical nature.

The flaw is a path traversal vulnerability within GitLab's repository commits API, allowing unauthenticated attackers to read arbitrary files from affected servers. Exploitation can occur when the application does not properly restrict file paths, enabling attackers to access files outside the intended directory structure. This vulnerability is particularly concerning as it requires no user account, interaction, or prior access, making it a significant threat to internet-exposed systems.

GitLab users running versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1 should immediately upgrade to versions 19.1.8, 19.2.6, 19.3.2, or later. The vulnerability has been included in CISA's Known Exploited Vulnerabilities catalog, with a remediation deadline set for September 14, 2026, for federal civilian executive branch agencies. Due to the potential that systems have already been compromised, forensic triage is advised.

Although CISA has not confirmed ransomware use through this vulnerability, GitLab servers remain high-value targets due to the sensitive data they typically host. Arbitrary file disclosure could reveal credentials and configuration details, making systems susceptible to further attacks. Security teams are urged to patch affected systems promptly, review logs for unusual activity, and rotate any exposed credentials.

The vulnerability was reported by security researcher s3ntago via GitLab's HackerOne bug bounty program, and is associated with CWE-35, which involves improper limitation of pathname access.