Skip to content
Tech News
← Back to articles

GitLab urges users to patch max severity path traversal flaw

2026-09-11 | original
read original get The Web Application Hacker's Handbook → more articles
Why This Matters

GitLab has patched a maximum-severity path traversal bug (CVE-2026-85706) that lets unauthenticated attackers read arbitrary files from self-managed servers, plus a critical deserialization flaw in its GraphQL subscription serializer (CVE-2026-87719). Because GitLab instances hold proprietary source code, credentials and CI/CD secrets, an unauthenticated file-read bug is a prime target for supply-chain attacks, and self-hosted admins carry the burden of patching.

Key Takeaways
Worth a Look

The Web Application Hacker's Handbook — Flaws like path traversal and insecure deserialization are exactly the bug classes this classic book dissects in depth. If reading about GitLab's max-severity CVE makes you want to understand how researchers find these issues (and how to keep them out of your own APIs), it's a great desk reference for developers and security teams alike.

See The Web Application Hacker's Handbook on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706.

The security flaw, discovered by a security researcher using the 's3ntago' handle and reported via GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API.

According to GitLab, unauthenticated attackers can exploit CVE-2026-85706 to read arbitrary files from vulnerable servers "under certain conditions."

Yesterday, GitLab patched a second critical vulnerability tracked as CVE-2026-87719 that stems from an insecure deserialization weakness in the GraphQL subscription serializer.

CVE-2026-87719 affects GitLab EE and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.

GitLab fixed the two security issues in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.3.2, 19.2.6, and 19.1 on Thursday, and urged users to patch their systems immediately.

"These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," the company warned on Thursday. "GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action."

In May 2023, GitLab addressed another maximum severity path traversal flaw (CVE-2023-2825) that exposes sensitive data, including proprietary software code, user credentials, tokens, and files on unpatched servers.

One year later, CISA and the FBI urged software companies to weed out path traversal security vulnerabilities from their products before shipping, saying that such flaws "have been called 'unforgivable' since at least 2007."

More recently, in January, GitLab also patched a high-severity two-factor authentication bypass affecting community and enterprise editions that enables attackers who know the target's account ID to circumvent two-factor authentication.

... continue reading

Explore topics: gitlab cve-2026-85706 path traversal hackerone graphql
Related:
Git hosting that never leaves Europe
Maiao: Gerrit-style code review workflow for GitHub, GitLab, Gitea, others
A Blackstone real estate company exposed SSN digits, DOBs, addresses and more
AI-Generated GitHub Copilot "Autofix" Allowed Compromise of Snowflake's Jira
Ask HN: Alternatives to GitHub

© 2026 GoKawiil

About | Editorial Policy | Contact