GitLab - Path Traversal (CVE-2026-85706)

CVE-2026-85706 is a critical path traversal vulnerability in GitLab CE/EE that, under certain conditions, allows unauthenticated attackers to read arbitrary files from the GitLab server through the repository commits API. Exploitation could expose sensitive configuration data, credentials, source code, and other confidential information, potentially enabling further compromise of connected systems.

CrowdSec has been tracking this vulnerability and its exploits since 28th of September 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-85706 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2026-85706 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2026-85706 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers target GitLab’s /api/v4/projects/{project-id}/repository/%66iles/ endpoint, using percent-encoding to bypass Workhorse route handling and query parameters such as file.path and file.size to trigger unauthenticated arbitrary file reads.