GitLab has confirmed that a maximum-severity security flaw in its Community and Enterprise Editions is now being actively exploited, just days after the company issued a patch. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalogue, warning that such flaws are frequently targeted by malicious actors and pose significant risks. The bug allows unauthenticated attackers to read arbitrary files from vulnerable servers, which is particularly dangerous given GitLab instances often store source code, configuration files and credentials.

The vulnerability is a path traversal flaw in the repository commits API, scoring a perfect 10.0 on the CVSS v3.1 scale, and stems from improper path confinement combined with missing authentication checks. GitLab released fixes on 10 September in versions 19.3.2, 19.2.6 and 19.1.8, covering affected releases from 18.7 up to those points; GitLab.com is already patched and GitLab Dedicated customers need not act. Security firm watchTowr reported observing exploitation attempts over the weekend, noting that a single HTTP request can be enough to extract sensitive data, and urged organisations running internet-facing self-hosted instances to patch immediately or take them offline, while advising admins to check logs for suspicious POST requests to the commits API.