GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released patches for a critical path traversal vulnerability, CVE-2026-85706, rated CVSS 10.0, which allows unauthenticated users to read arbitrary files from servers running affected versions of GitLab CE and EE. Exposure management firm watchTowr confirmed that active probes began immediately after the flaw was disclosed, targeting log files and configuration data to exfiltrate credentials.

This defect impacts all versions prior to 19.1.8, 19.2.6, and 19.3.2 respectively, stemming from improper path confinement in the repository commits API. While this is the second major breach vector following recent GraphQL issues, experts warn that mass exploitation is imminent and advise administrators to update their systems or restrict public access to mitigate the risk.