Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

GitLab Urges Patching as Attackers Probe Critical File-Read Flaw

Part of the CVE-2026-85706 story · since 11 Sep

Quiet for 2 weekslast report 13 Oct12 articles8 outlets
11 Sep · SecurityOnline first8 Oct17 OctNowThis article7th of 12
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV. This article, 7th of 12.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.

GitLab users have been urged to patch CVE-2026-85706, a maximum-severity path-traversal vulnerability reportedly being probed in the wild. The flaw affects GitLab CE/EE versions 18.7 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2. According to GitLab’s advisory, under certain conditions an unauthenticated attacker could read arbitrary files from a GitLab server because of inadequate path confinement and missing authentication enforcement in the repository commits API. GitLab fixed the issue on 10 September 2026.

GitLab had not itself confirmed exploitation, but cybersecurity vendor watchtower said on 11 September that it had detected “in-the-wild probes” targeting the vulnerability. It warned that indiscriminate exploitation could follow and recommended that organisations with publicly accessible, self-hosted GitLab instances patch immediately or remove public access.

To look for possible attacks, watchtower advised reviewing logs for HTTP POST requests to `/api/v4/projects/{id}/repository/commits/` containing `file.path` parameters.

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue on the same day, giving civilian federal agencies a 15 September deadline to address it and recommending that organisations follow applicable BOD 26-04 guidance for cloud services or discontinue use where mitigations are unavailable.

How the story developed

All 12 articles
Quiet for 2 weekslast report 13 Oct12 articles8 outlets

12 articles from 8 outlets since 11 Sep. Quiet since 13 Oct. This was the 7th report, 3 days after the first.

Now11 Sep1213141512 Oct13First reportSecurityOnline · 11 Sep, 01:30This article7th of 12 · day 3
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV. This article, 7th of 12.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Fri 11 SepDay 04
    1. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files01:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Attackers Exploit Critical GitLab Flaw Within a Day of Patches16:30 · SecurityWeek · Known exploited CVE
    3. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets17:37 · The Hacker News · Known exploited CVE
    4. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files20:33 · CISA · official · CISA alert · Known exploited CVE

  2. Quiet for 2 days

    Sun 13 SepDay 21
    1. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers12:47 · Security Affairs · Known exploited CVE
  3. Mon 14 SepDay 35
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE
    2. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw10:11 · Infosecurity · Known exploited CVE · This article, 7th of 12
    3. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching11:57 · Rapid7 · Known exploited CVE
    Show 2 more from 14 Sep
    1. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE
    2. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw21:05 · Dark Reading · Known exploited CVE

  4. Quiet for 4 weeks

    Mon 12 OctDay 311
    1. Actively Exploited Vulnerabilities Jump to 100 in Q3 202604:01 · SecurityOnline · Picked up again · Known exploited CVE
  5. Tue 13 OctDay 321
    1. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in