GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
CVE-2026-85706 Exploited
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Being exploited in the wild
Catalogued 11 September 2026 · US federal remediation deadline 14 September 2026
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for…
Exploit code is also public: Metasploit · Public PoC · Nuclei template
- Metasploitauxiliary/gather/gitlab_file_read_cve_2026_85706
- NucleiGitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
- Public PoCguneykabel/cve-2026-8570644 stars
- Public PoCEQSTLab/CVE-2026-8570629 stars
- Public PoCynsmroztas/GitLabSniper9 stars
- Public PoC0xlyvio/cve-2026-85706-poc-exploit-gitlab4 stars
- Public PoCFlowerWitch/CVE-2026-85706_docker_exp2 stars
- Public PoCjithinkrishnanrs/gitlab-cve-2026-85706-ioc2 stars
- Public PoCgagaltotal/CVE-2026-85706-gitlab-poc1 stars
- Public PoCplur1bu5/gitread1 stars
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Yes — listed in the CISA KEV catalog
- Exploit availability
- CISA KEV, Metasploit, Public PoC, Nuclei template
- Published
- 11 September 2026
- Last updated
- 11 September 2026
- Affected
- GitLab · Community Edition and Enterprise Edition
- Weakness
- CWE-35
At the source
References
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://www.cve.zerocrew.in/api/cve/CVE-2026-85706