The U.S This article explores exploited affecting gitlab. . Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical GitLab path traversal vulnerability, tracked as CVE-2026-85706, and added it to its catalog of known exploited vulnerabilities.
The flaw is being actively exploited, affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). CISA Issues Critical GitLab Path Traversal Vulnerability Warning The flaw is classified as CWE-35, a path traversal weakness that occurs when an application fails to properly restrict file-path operations to an expected directory. The agency stated that the issue necessitates a forensic triage under Binding Operational Directive (BOD) 26-04, which prioritizes remediation based on exploitation risk and asset exposure.
Although CISA has not confirmed the use of ransomware campaigns, the vulnerability’s unauthenticated nature and arbitrary file-read impact make it highly attractive to initial-access brokers and opportunistic threat actors. Administrators should also limit public access to GitLab where possible, review reverse-proxy and application logs for suspicious repository commit API requests, and search for traversal-style payloads like encoded directory-separator sequences. Teams should rotate credentials and secrets stored on potentially affected servers, especially GitLab runner tokens, personal access tokens, SSH keys, CI/CD variables, cloud credentials, and database passwords.
