GitLab Unauthenticated Arbitrary File Read via the Repository Commits API

Wambua Thyaka@thyaka

•updated 6 days ago•6•0•43

CVE-2026-85706 is a critical path traversal vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). The Flaw: The issue originates in the repository commits/files API. The API processes file paths and reads them from the disk before verifying user authentication or restricting the path to the designated repository folder. The Impact: A remote attacker can exploit this weakness with a single HTTP request. Because it requires zero credentials and no user interaction, attackers can easily read arbitrary, potentially sensitive files directly from the host GitLab server.