Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity.
CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attackers to read arbitrary files in a single HTTP request. The path traversal flaw results from improper confinement and lack of authentication enforcement in GitLab’s repository commits API, the company reported.
Threat actors could exploit it “under certain conditions” and read arbitrary files (credentials, secrets, and other sensitive data) on vulnerable GitLab servers.
The company has fixed the vulnerability, which impacts GitLab Community Edition (CE) and ...