Skip to content

CVE-2026-85706

Path Traversal in GitLab Community Edition and Enterprise Edition. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 11 September 2026.

Product
GitLab Community Edition and Enterprise Edition
Added to CISA's catalog
Federal fix-by date
Ransomware
No known use in ransomware campaigns
Vendor advisories
Sources
CISA’s catalog, NVD entry

CISA’s description.

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.

More from GitLab this year.

  • CVE-2026-97229 Integer Overflow or Wraparound, added
  • CVE-2021-22175 Server-Side Request Forgery (SSRF), added
  • CVE-2021-39935 Server-Side Request Forgery (SSRF), added

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.