Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
6
5
Contributors
8
2
1
Categories
10
10
5
Platforms
10
10
Products / Services
10
5
5
5
MITRE Techniques
6
5
CVEs
71
71
64
58
49
IDS Classtypes
5
IDS Protocols
5
CVE-2026-85706 is a critical path traversal vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE).
The Flaw: The issue originates in the repository commits/files API. The API processes file paths and reads them from the disk before verifying user authentication or restricting the path to the designated repository folder.
The Impact: A remote attacker can exploit this weakness with a single HTTP request. Because it requires zero credentials and no user interaction, attackers can easily read arbitrary, potentially sensitive files directly from the host GitLab server.
The Flaw: The issue originates in the repository commits/files API. The API processes file paths and reads them from the disk before verifying user authentication or restricting the path to the designated repository folder.
The Impact: A remote attacker can exploit this weakness with a single HTTP request. Because it requires zero credentials and no user interaction, attackers can easily read arbitrary, potentially sensitive files directly from the host GitLab server.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.