Attackers Probe GitLab Path Traversal One Day After Patch

WatchTowr, an attack surface management firm, reported probes and exploitation attempts for a critical GitLab path traversal vulnerability, CVE-2026-85706, started one day after GitLab released patches. The flaw can let unauthenticated users read arbitrary files from vulnerable servers using a single HTTP request.

The vulnerability affects self-hosted GitLab Community Edition and Enterprise Edition across several release ranges: any versions from 18.7 up to but not including 19.1.8, from 19.2 up to but not including 19.2.6, and from 19.3 up to but not including 19.3.2. GitLab published fixes in versions 19.1.8, 19.2.6 and 19.3.2. The issue has a CVSS score of 10.0.

WatchTowr advised defenders to search server logs for HTTP POST requests to the /api/v4/projects/{id}/repository/commits/ endpoint that include file.path parameters to detect exploitation attempts. In its advisory, WatchTowr wrote: “WatchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request.”

GitLab’s patch release also addressed 17 other vulnerabilities. One classified as critical, CVE-2026-87719, is an insecure deserialization bug in the GraphQL subscription serializer with a CVSS score of 9.9; that defect can allow access to Advanced Search instance configurations and sensitive credentials. The updates additionally resolve six high-severity issues that can enable remote code execution, expose protected CI/CD variables, permit cross-site scripting attacks, or cause denial-of-service conditions.

Security firms recommend that organizations running self-hosted GitLab instances install the patched releases immediately and search logs for indicators of compromise tied to the mentioned endpoint and parameter. Administrators should apply the updates and monitor systems for related activity.