**GitLab** is urging users to immediately patch their servers against a critical path traversal vulnerability, tracked as **CVE-2026-85706**. This flaw, identified by security researcher '**s3ntago**' and reported via **GitLab**'s HackerOne bug bounty program, stems from improper path confinement and a lack of authentication enforcement within the repository commits API. ### Unauthenticated Access to Sensitive Data Under specific conditions, unauthenticated attackers can exploit **CVE-2026-85706** to read arbitrary data, including credentials, secrets, and other sensitive information, from vulnerable servers. ### Active Probing Detected While **GitLab** has not yet confirmed in-the-wild exploitation, cybersecurity firm **watchTowr** reported that attackers have already begun actively searching for internet-exposed **GitLab** servers that remain unpatched against **CVE-2026-85706**. **watchTowr** warned, "watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request." They further emphasized the urgency: "Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away. Defenders should also hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts." ### Additional Critical Flaw Addressed **GitLab** also patched a second critical vulnerability, **CVE-2026-87719**, an insecure deserialization issue in the GraphQL subscription serializer. This flaw affects **GitLab EE** and could allow authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations. ### Immediate Patching is Crucial Both security issues have been addressed in **GitLab Community Edition (CE)** and **Enterprise Edition (EE)** versions 19.3.2, 19.2.6, and 19.1. **GitLab** strongly recommends that all self-managed installations be upgraded to one of these versions immediately. **GitLab.com** is already running the patched version, and **GitLab Dedicated** customers do not need to take action. ### A History of Path Traversal Vulnerabilities This is not the first time **GitLab** has faced critical path traversal issues. In May 2023, a similar maximum-severity flaw (**CVE-2023-2825**) exposed sensitive data. More recently, the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** and the **FBI** urged software companies to eliminate path traversal vulnerabilities from their products, noting such flaws have been considered "unforgivable" since at least 2007. **GitLab** has also patched other high-severity issues, including a two-factor authentication bypass in January. Since November 2021, **CISA** has flagged four **GitLab** vulnerabilities as exploited in attacks, highlighting the ongoing threat landscape for the platform, which boasts over 30 million registered users and is utilized by more than 50% of Fortune 100 companies.