Detections
Analytics

GitLab 18.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 Path Traversal

critical Web App Scanning Plugin ID 115473

Language:

Synopsis

GitLab 18.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 Path Traversal

Description

GitLab CE/EE versions starting from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected by a path traversal vulnerability in the repository commits and repository files API endpoints. The Rails handlers read the on-disk path straight from the attacker controlled `file.path` request parameter and open the file before any authentication check, while the Workhorse route matching can be bypassed with an encoded path segment, a trailing slash or a format suffix. A remote, unauthenticated attacker can leverage this issue to read arbitrary files from the GitLab server, the content being echoed back in the Rack parameter parser error message.

Note that the vendor advisory referenced below also addresses additional vulnerabilities fixed in the same releases.

Solution

Upgrade to GitLab version 19.1.8, 19.2.6, 19.3.2 or later.

See Also

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

https://gitlab.com/gitlab-org/gitlab/-/commit/0d9ce3e758a85f0690be751e213625f7902c0361

Plugin Details

Severity: Critical

ID: 115473

Type: Check Based

Published: 9/14/2026

Updated: 9/14/2026

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Critical

Score: 9.1

Percentile: 99.76

CVSS v2

Risk Factor: High

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-85706

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CVSS Score Source: CVE-2026-85706

Vulnerability Information

CPE: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/10/2026

Vulnerability Publication Date: 8/23/2026

CISA Known Exploited Vulnerability Due Dates: 9/14/2026

Reference Information

CVE: CVE-2026-85706