GitLab - Path Traversal (CVE-2026-85706)

CVE-2026-85706 is a critical path traversal vulnerability in GitLab CE/EE that, under certain conditions, allows unauthenticated attackers to read arbitrary files from the GitLab server through the repository commits API. Exploitation could expose sensitive configuration data, credentials, source code, and other confidential information, potentially enabling further compromise of connected systems.

CrowdSec has been tracking this vulnerability and its exploits since 28th of September 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-85706 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. CrowdSec network telemetry also shows that exploitation of CVE-2026-85706 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers target GitLab’s /api/v4/projects/{project-id}/repository/%66iles/ endpoint, using percent-encoding to bypass Workhorse route handling and query parameters such as file.path and file.size to trigger unauthenticated arbitrary file reads.