CTI · reported · 2026-09-13

GitLab Vulnerability Exploited One Day After Disclosure

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1083 File and Directory Discovery Discovery

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: GitLab CVE-2026-85706 Path Traversal via Commits API
id: 7f2e3a4c-8b1d-4e9f-a6c2-d5e8f1b3a7c0
status: experimental
description: Detects exploitation attempts of CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab repository commits API that allows reading arbitrary files from self-managed servers.
references:
  - https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/
author: Tia N. List
date: 2026-09-13
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.85706
logsource:
  category: webserver
  product: gitlab
detection:
  selection:
    cs-method: POST
    cs-uri|contains: '/api/v4/projects/'
    cs-uri|contains: '/repository/commits'
    cs-uri|contains: 'file.path'
  condition: selection
falsepositives:
  - Legitimate GitLab API usage with file.path parameter (unlikely in normal operations)
level: critical

References

• https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/