GitLab has released security updates for its Community and Enterprise editions to address multiple vulnerabilities, including two critical flaws. The patches cover versions 19.3.2, 19.2.6, and a fix for the 19.1 branch. These updates resolve issues related to path traversal in the repository commit API and insecure deserialization in the GraphQL subscription serializer.
The path traversal vulnerability, identified as CVE-2026-85706, carries a maximum severity rating of 10 out of 10. It stems from missing authentication and improper file system access restrictions, allowing unauthorized actors to read sensitive data, including credentials. Security researchers from watchTowr confirmed active exploitation attempts, noting that a single HTTP request can expose arbitrary files.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog. This designation mandates that government agencies apply the necessary patches within three days. GitLab, which serves over 50 million registered users and half of the Fortune 100 companies, advises administrators to check logs for suspicious POST requests.
To detect potential exploitation attempts, security experts recommend monitoring logs for HTTP POST requests directed at the URI path /api/v4/projects/{id}/repository/commits/ that contain the file.path parameter. Given the active nature of these attacks, users are urged to prioritize updating their server installations immediately to mitigate the risk of unauthorized data access.
