Overview
- GitLab published emergency fixes on Thursday that update Community and Enterprise editions to versions 19.3.2, 19.2.6 and 19.1 and said GitLab.com was already running the patched code.
- The flaw, tracked as CVE-2026-85706, is a path traversal bug in the repository commits API that can let an unauthenticated attacker read arbitrary files from a vulnerable server under certain conditions.
- WatchTowr reported active probes for the flaw on Friday and warned that mass exploitation is likely, advising defenders to search logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ that include 'file.path' parameters.
- Organizations running self-hosted GitLab instances should apply the supplied patches immediately or restrict public access, and validate patching because the fixes also close many other high-severity issues.
- GitLab serves millions of developers and large enterprises, has a recent history of high-impact fixes, and concurrently patched a separate critical insecure-deserialization bug (CVE-2026-87719) that affects Enterprise Edition.