GitLab released security patches this week addressing a critical path traversal vulnerability that triggered active exploitation attempts within hours of becoming public. The flaw, tracked as CVE-2026-85706, carries a perfect CVSS score of 10.0 and allows unauthenticated attackers to read arbitrary files from affected GitLab installations.
The vulnerability resides in the repository commits API. An attacker with no credentials can exploit the path traversal flaw to access sensitive files stored on the GitLab server, including configuration files, private keys, database credentials, and other confidential data. The attack requires minimal technical sophistication. An attacker simply manipulates API parameters to traverse directory structures and retrieve files outside intended access boundaries.
GitLab's threat intelligence team detected reconnaissance probes exploiting this flaw almost immediately after the advisory went public. These early scans suggest threat actors have already begun testing vulnerable instances across the internet. Organizations running unpatched GitLab deployments now face active risk.
The maximum CVSS score reflects the combination of attack vector (network), attack complexity (low), and impact scope. No authentication is required. An attacker from anywhere on the internet can exploit this vulnerability without credentials or special permissions. The potential blast radius extends across all public-facing GitLab instances and many internal deployments accessible to attackers through compromised networks or exposed endpoints.
Organizations operating self-hosted GitLab installations must prioritize patching. Cloud-based GitLab.com users benefit from automatic patching through GitLab's managed service, but those running GitLab Community Edition, GitLab Premium, or GitLab Ultimate on their own infrastructure need to apply updates manually.
The vulnerability affects GitLab versions prior to 17.5.2, 17.6.x before 17.6.1, and 17.7.x before 17.7.1. Administrators should check their current version immediately and deploy patches without delay. The path traversal mechanism functions through a specific API endpoint that processes repository commit data. By injecting directory traversal sequences like "../" into API requests, attackers bypass GitLab's intended file access controls.
This disclosure highlights a recurring pattern in GitLab's security history. The platform has experienced multiple critical vulnerabilities requiring emergency patches over recent years. Organizations relying on GitLab should maintain strict change management protocols and patch management schedules, particularly for remote code execution and authentication bypass issues.
Beyond patching, organizations should review access logs for suspicious repository API requests, particularly those containing path traversal patterns. GitLab access logs record API endpoint calls, source IPs, and timestamp data. Analyzing logs retroactively can reveal whether attackers probed systems before patches were applied.
The in-the-wild probes confirm this vulnerability represents immediate, practical risk rather than theoretical concern. Threat actors typically don't scan for newly disclosed critical flaws unless exploitation is straightforward and high-value targets exist. The rapid proof-of-concept development and deployment scanning underscore the urgency for rapid patching.