GitLab has urged all self-managed server operators to apply patches immediately after disclosing a maximum-severity GitLab path traversal flaw tracked as CVE-2026-85706, a vulnerability that allows unauthenticated attackers to read arbitrary files from vulnerable servers under certain conditions. The flaw was reported through GitLab’s HackerOne bug bounty programme by a security researcher using the handle ‘s3ntago’, and stems from improper path confinement combined with missing authentication enforcement in the repository commits API.
According to GitLab Official Documentation, the vulnerability affects all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. That is a broad swath of the self-managed install base. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.
What the GitLab path traversal flaw release actually contained
The fixes landed in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.3.2, 19.2.6, and 19.1. CVE-2026-85706 was not the only concern in that coordinated release. According to Greenbone, the patch bundle addressed 17 other CVEs alongside CVE-2026-85706, with one additional vulnerability rated critical severity. That kind of density in a single patch release is a useful reminder that waiting even a few days to apply updates carries compounding risk.
The second critical issue, CVE-2026-87719, was patched the day before. It arises from an insecure deserialisation weakness in the GraphQL subscription serialiser, affects GitLab EE, and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations. Where CVE-2026-85706 requires no authentication at all, CVE-2026-87719 demands only a foothold inside the platform, making both credible threats across different attacker profiles.
‘These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,’ GitLab warned when releasing the patches.
A pattern GitLab has been dealing with for years
This is not GitLab’s first encounter with maximum-severity path traversal issues. In May 2023 the company addressed CVE-2023-2825, a flaw of the same class that exposed proprietary software code, user credentials, tokens, and files on unpatched servers. Path traversal vulnerabilities have attracted particular attention from regulators: in the year following that patch, CISA and the FBI issued guidance urging software companies to eliminate path traversal flaws before shipping, describing such issues as having been called ‘unforgivable’ since at least 2007.
GitLab’s patch cadence has been busy more broadly. In January the platform addressed a high-severity two-factor authentication bypass affecting both community and enterprise editions, one that enabled attackers who knew a target’s account ID to circumvent two-factor authentication entirely. Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four GitLab vulnerabilities to its Known Exploited Vulnerabilities catalogue, including two, CVE-2021-22175 and CVE-2021-39935, flagged as exploited in attacks earlier this year.
The scale of the exposure
The platform’s reach makes prompt patching more than a housekeeping matter. GitLab has more than 30 million registered users and is used by over 50% of Fortune 100 companies, including Nvidia, Airbus, T-Mobile, Lockheed Martin, Goldman Sachs, and UBS. A GitLab path traversal flaw that exposes arbitrary files on a repository server is, in practice, a potential window into a significant portion of the world’s software supply chain.
For self-managed operators still running any version in the 18.7 to 19.3.1 range, the upgrade path is straightforward: 19.1.8, 19.2.6, or 19.3.2 all carry the fixes. GitLab’s own guidance leaves little room for interpretation on timing.
