GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Researchers have observed in-the-wild exploitation attempts targeting this GitLab flaw. Customers are advised to upgrade as soon as possible.

This maximum severity path traversal flaw in GitLab should be patched as soon as possible. Tenable Research is monitoring for signs of exploitation.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read     arbitrary files from the GitLab server due to improper path confinement and missing authentication     enforcement in the repository commits API. (CVE-2026-85706)

  - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0     before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain     conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper     path confinement and missing authentication enforcement in the repository commits API. (CVE-2026-85706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

GitLab CE/EE versions starting from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected by a path traversal vulnerability in the repository commits and repository files API endpoints. The Rails handlers read the on-disk path straight from the attacker controlled `file.path` request parameter and open the file before any authentication check, while the Workhorse route matching can be bypassed with an encoded path segment, a trailing slash or a format suffix. A remote, unauthenticated attacker can leverage this issue to read arbitrary files from the GitLab server, the content being echoed back in the Rack parameter parser error message.

Note that the vendor advisory referenced below also addresses additional vulnerabilities fixed in the same releases.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7fd351d1-af26-11f1-a883-2cf05da270f3 advisory.

    Gitlab reports:
    Path Traversal issue in repository commits API impacts GitLab CE/EE     Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE     Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE     Scheduled Pipeline Execution Policy test allows Developers to access protected CI/CD variables     Cross-site Scripting issue in Markdown JSON table renderer impacts GitLab CE/EE     Incorrect Authorization issue in CI/CD environment variable scope matcher impacts GitLab CE/EE     Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE     Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE     Race Condition issue in Merge Request Pipelines impacts GitLab CE/EE     Improper Authentication issue in SAML SSO sign-in restriction enforcement impacts GitLab CE/EE     Insufficiently Protected Credentials issue in Workhorse senddata emitters impacts GitLab CE/EE     Cross-site Scripting issue in Content Editor impacts GitLab CE/EE     Access Control Implementation issue in protected environment approval rules impacts GitLab EE     Authorization Bypass issue in protected environment approval rules impacts GitLab EE     Missing Authorization issue in Generic Package Registry impacts GitLab CE/EE     Improper Input Validation issue in Namespace Transfer impacts GitLab CE/EE     Missing Authorization issue in Compliance Framework management impacts GitLab EE     Improper Input Validation issue in Terraform State API impacts GitLab CE/EE

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
346267	GitLab 18.7 < 18.11.12 / 19.0 < 19.0.9 / 19.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-85706)	Nessus	CGI abuses	Combined	critical
115473	GitLab 18.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 Path Traversal	Web App Scanning	Component Vulnerability	Check Based	critical
345466	FreeBSD : Gitlab -- vulnerabilities (7fd351d1-af26-11f1-a883-2cf05da270f3)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-85706

critical

Tenable Plugins

critical

critical

medium