The U.S This article explores vulnerability impacts gitlab. . Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical GitLab path traversal vulnerability, tracked as CVE-2026-85706, and added it to its Known Exploited Vulnerabilities catalog following evidence of the flaw being actively exploited.
The vulnerability impacts both GitLab Community Edition (CE) and Enterprise Edition (EE). The issue arises from insufficient path confinement and a lack of authentication enforcement in the repository commits API, allowing attacker-controlled path values to bypass the intended repository directory. CISA Issues Alert for Critical GitLab Path Traversal Vulnerability The vulnerability is classified as CWE-35, a path traversal flaw that occurs when an application fails to properly restrict file-path operations to an expected directory.
The agency stated that the issue necessitates a forensic triage under the Binding Operational Directive (BOD) 26-04, which prioritizes remediation based on exploitation risk and asset exposure. Although CISA has not identified confirmed ransomware-campaign use, the vulnerability’s unauthenticated nature and arbitrary file-read impact make it highly attractive to initial-access brokers and opportunistic threat actors. Administrators should also control public access to GitLab where possible, review logs for unusual repository commit API requests, and look for traversal-style payloads like encoded directory-separator sequences.
