CVE-2026-85706

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-85706 10.0

GitLab · Community Edition and Enterprise Edition · Added 2026-09-11

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityGitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

VendorGitLab

ProductCommunity Edition and Enterprise Edition

Date added2026-09-11

Due date2026-09-14

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-22 CWE-862

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Descriptions

KEV: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-11 22:25 UTC

Wall time0.5s

Searches2

Component defaultyes

Sources https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
https://github.com/guneykabel/cve-2026-85706
https://securityonline.info/gitlab-vulnerabilities-cve-2026-85706-cvss-10/
https://gitlab.com/gitlab-org/gitlab/-/commit/0d9ce3e758a85f0690be751e213625f7902c0361
https://nvd.nist.gov/vuln/detail/CVE-2026-85706

Hunting hypothesis agent

Hunt GitLab access logs for POST requests to repository API with percent-encoded path segments (%63ommits, %66iles) and file.path set to absolute paths; contents leak in 400 bodies via 'Invalid %-encoding' when Content-Type is urlencoded

Research details

Componentrepository commits and files API Workhorse file upload handler (commits.rb, files.rb, commits_body_uploader_helper.rb)

PreconditionsAffected GitLab CE/EE versions 18.7 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 must be running. The target project must be anonymously readable so the commits API endpoint is reachable. No authentication or special user privileges are required. Network access to the GitLab web interface is needed. agent

Public PoCyes

PoC URLs https://github.com/guneykabel/cve-2026-85706 Third-party repos; verify before use.

Advisoryhttps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

Exploit notesFunctional public PoC with exploit.py cycles through all verified bypass forms (percent-encoded segments like %63ommits and %66iles, trailing slash, .json suffix). The bypass exploits a mismatch between Workhorse's route regex (which matches EscapedPath() without decoding %XX) and Puma (which decodes %XX before Grape routing). Data exfiltration works by sending Content-Type application/x-www-form-urlencoded so Rack::Utils.parse_nested_query reads the target file and interpolates its contents into the InvalidParameterError 400 response body. CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Active in-the-wild exploitation confirmed by watchTowr on September 11, 2026.

SummaryCritical unauthenticated arbitrary file read in GitLab CE/EE via path traversal in the repository commits and files API endpoints. A Workhorse route-regex bypass using percent-encoded URL path segments allows unauthenticated requests to reach Rails handlers that read attacker-supplied file paths. File contents are exfiltrated through crafted HTTP 400 error responses. Fixed in versions 19.1.8, 19.2.6, and 19.3.2; active exploitation observed in the wild.

Tia coverage

First reported2026-09-08

First exploit report2026-09-11

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-4-known-exploited-vulnerabilities-to-catalog-september gitlab-ai-gateway-cve-2026-90970-critical-auth-escape gitlab-s-critical-flaw-is-already-drawing-internet-wide-probes proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.