CTI · reported · 2026-09-16

GitLab Critical CVE-2026-85706 Under Active Exploitation - Unauthenticated Path Traversal

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1083 File and Directory Discovery Discovery

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: GitLab CVE-2026-85706 Path Traversal via Commits API
id: 8a3b2c1d-4e5f-6789-abcd-ef0123456789
status: experimental
description: >
    Detects exploitation of CVE-2026-85706, a critical path traversal
    vulnerability in GitLab's repository commits API. Attackers send
    a single HTTP POST request to /api/v4/projects/{id}/repository/commits/
    with a crafted file.path parameter to read arbitrary files from the
    server. The flaw scores CVSS 10.0 and requires no authentication
    beyond a public project on the instance.
references:
  - https://censys.com
  - https://insomnisec.com
  - https://meterpreter.org
author: Tia N. List
date: 2026-09-16
tags:
  - attack.initial-access
  - attack.t1190
  - attack.discovery
  - attack.t1083
logsource:
  product: linux
  category: webserver
detection:
  selection_api_endpoint:
    cs-method: POST
    cs-uri|contains: '/api/v4/projects/'
    cs-uri|contains: '/repository/commits'
  selection_path_traversal:
    cs-uri|contains:
      - 'file.path=..'
      - 'file.path=%2e%2e'
      - 'file.path=../'
  condition: selection_api_endpoint and selection_path_traversal
falsepositives:
  - Legitimate GitLab API usage with file operations (unlikely to match traversal patterns)
level: critical

References

• https://censys.com
• https://insomnisec.com
• https://meterpreter.org