GitLab on Thursday released CE/EE updates for two critical and six high-severity flaws, including CVE-2026-85706, a path-traversal bug in the repository commits API affecting 19.1.x, 19.2.x, and 19.3.x before 19.1.8, 19.2.6, and 19.3.2. WatchTowr said probes for the flaw began within hours of disclosure.
The bug lets a request point the commits API at a path it should not reach, so an unauthenticated user can read arbitrary files on the GitLab server. That matters because those files can include source code, GitLab configuration, logs, CI/CD variables, and credentials, so the issue is not confined to one project or one page.
For self-managed GitLab instances, the exposure sits in the server filesystem and can reach into downstream build and deployment systems if secrets live there. GitLab also fixed another critical flaw and six high-severity bugs in the same release, so the patch changes the trust picture for any internet-facing instance that holds code and pipeline secrets.