GoKawiilGitLab patches maximum-severity path traversal bug in commits API
GitLab issued emergency patches for CVE-2026-85706, a maximum-severity path traversal flaw in its repository commits API that lets unauthenticated attackers read arbitrary files on vulnerable servers. The company also fixed a second critical bug, CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer that could let authenticated Duo Chat users steal credentials and Advanced Search configurations. Both flaws are addressed in versions 19.3.2, 19.2.6, and 19.1.
GoKawiil's interpretation of the reporting above, not reported fact.
Path traversal bugs remain a persistent, well-known risk class that regulators have called 'unforgivable' for over a decade, yet keep surfacing in major platforms like GitLab. Given GitLab's role hosting proprietary source code and secrets for countless organizations, unpatched self-managed instances present a high-value target for attackers seeking source code theft or credential compromise.
- CVE-2026-85706 allows unauthenticated file reads via GitLab's commits API under certain conditions.
- CVE-2026-87719 lets authenticated Duo Chat users exploit deserialization flaws to steal credentials.
- Self-managed GitLab instances must upgrade immediately; GitLab.com and Dedicated customers are already protected.
The Web Application Hacker's Handbook — Flaws like path traversal and insecure deserialization are exactly the bug classes this classic book dissects in depth. If reading about GitLab's max-severity CVE makes you want to understand how researchers find these issues (and how to keep them out of your own APIs), it's a great desk reference for developers and security teams alike.
See The Web Application Hacker's Handbook on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-11
Published there as: “GitLab urges users to patch max severity path traversal flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.